fix: matrix-job data races + outputs, leaner offline test suite (#994)

Running the full suite under `-race` (dropping `-short`) exposed pre-existing data races in parallel matrix-job execution, fixed by not sharing mutable state across combinations:

- `containerDaemonSocket()`/`validVolumes()` derive per-job values instead of mutating shared `Config`
- `getWorkflowSecrets` builds a fresh map, `rc.steps()` clones each step, and go-git workdir access is serialized
- every write to a shared `Job`'s result/outputs runs under a per-`Job` lock, each combo interpolating outputs from a pristine snapshot (last wins, as on GitHub)

### Test suite

- capability gates (docker / network / host-tools / Linux) replace the `-short` skips, and the suite runs offline via local fixtures (the artifact flow uses an in-process loopback server, only the docker-action force-pull needs the network)
- drops redundant tests, adds a regression test for https://gitea.com/gitea/runner/issues/981 and a docker-in-docker harness (`make test-dind`)

---
This PR was written with the help of Claude Opus 4.7

Reviewed-on: https://gitea.com/gitea/runner/pulls/994
Reviewed-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

act/runner/testdata/actions/script/action.yml

@@ -0,0 +1,15 @@
+name: 'script'
+description: 'Run the shell scripts passed as inputs across the pre/main/post lifecycle'
+inputs:
+  main:
+    description: 'shell script to run in the main step'
+    required: false
+    default: ''
+  post:
+    description: 'shell script to run in the post step'
+    required: false
+    default: ''
+runs:
+  using: 'node24'
+  main: 'index.js'
+  post: 'post.js'

act/runner/testdata/actions/script/index.js

@@ -0,0 +1,9 @@
+import {execFileSync} from 'node:child_process';
+
+// Run the `main` input as a bash script; its stdout (workflow commands like
+// ::set-output / ::save-state) and $GITHUB_ENV / $GITHUB_STATE writes are
+// processed by the runner, exactly like the remote script action this replaces.
+const script = process.env.INPUT_MAIN;
+if (script) {
+  execFileSync('bash', ['-eo', 'pipefail', '-c', script], {stdio: 'inherit'});
+}

act/runner/testdata/actions/script/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "script",
+  "private": true,
+  "type": "module"
+}

act/runner/testdata/actions/script/post.js

@@ -0,0 +1,6 @@
+import {execFileSync} from 'node:child_process';
+
+const script = process.env.INPUT_POST;
+if (script) {
+  execFileSync('bash', ['-eo', 'pipefail', '-c', script], {stdio: 'inherit'});
+}