fix: matrix-job data races + outputs, leaner offline test suite (#994)

Running the full suite under `-race` (dropping `-short`) exposed pre-existing data races in parallel matrix-job execution, fixed by not sharing mutable state across combinations:

- `containerDaemonSocket()`/`validVolumes()` derive per-job values instead of mutating shared `Config`
- `getWorkflowSecrets` builds a fresh map, `rc.steps()` clones each step, and go-git workdir access is serialized
- every write to a shared `Job`'s result/outputs runs under a per-`Job` lock, each combo interpolating outputs from a pristine snapshot (last wins, as on GitHub)

### Test suite

- capability gates (docker / network / host-tools / Linux) replace the `-short` skips, and the suite runs offline via local fixtures (the artifact flow uses an in-process loopback server, only the docker-action force-pull needs the network)
- drops redundant tests, adds a regression test for https://gitea.com/gitea/runner/issues/981 and a docker-in-docker harness (`make test-dind`)

---
This PR was written with the help of Claude Opus 4.7

Reviewed-on: https://gitea.com/gitea/runner/pulls/994
Reviewed-by: Nicolas <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-committed-by: silverwind <me@silverwind.io>

act/runner/testdata/uses-workflow/local-workflow.yml

@@ -1,42 +0,0 @@
-name: local-reusable-workflows
-on: pull_request
-
-jobs:
-  reusable-workflow:
-    uses: ./.github/workflows/local-reusable-workflow.yml
-    with:
-      string_required: string
-      bool_required: ${{ true }}
-      number_required: 1
-    secrets:
-      secret: keep_it_private
-
-  reusable-workflow-with-inherited-secrets:
-    uses: ./.github/workflows/local-reusable-workflow.yml
-    with:
-      string_required: string
-      bool_required: ${{ true }}
-      number_required: 1
-    secrets: inherit
-
-  reusable-workflow-with-on-string-notation:
-    uses: ./.github/workflows/local-reusable-workflow-no-inputs-string.yml
-
-  reusable-workflow-with-on-array-notation:
-    uses: ./.github/workflows/local-reusable-workflow-no-inputs-array.yml
-
-  output-test:
-    runs-on: ubuntu-latest
-    needs:
-      - reusable-workflow
-      - reusable-workflow-with-inherited-secrets
-    steps:
-      - name: output with secrets map
-        run: |
-          echo reusable-workflow.output=${{ needs.reusable-workflow.outputs.output }}
-          [[ "${{ needs.reusable-workflow.outputs.output == 'string' }}" = "true" ]] || exit 1
-
-      - name: output with inherited secrets
-        run: |
-          echo reusable-workflow-with-inherited-secrets.output=${{ needs.reusable-workflow-with-inherited-secrets.outputs.output }}
-          [[ "${{ needs.reusable-workflow-with-inherited-secrets.outputs.output == 'string' }}" = "true" ]] || exit 1

act/runner/testdata/uses-workflow/push.yml

@@ -1,8 +1,11 @@
 on: push
 
+# Exercises the reusable-workflow caller path against a local reusable workflow: passing typed
+# inputs and secrets (both an explicit map and `inherit`), and reading the called workflow's
+# outputs back through `needs`.
 jobs:
   reusable-workflow:
-    uses: nektos/act-test-actions/.github/workflows/reusable-workflow.yml@main
+    uses: ./.github/workflows/local-reusable-workflow.yml
     with:
       string_required: string
       bool_required: ${{ true }}
@@ -11,7 +14,7 @@ jobs:
       secret: keep_it_private
 
   reusable-workflow-with-inherited-secrets:
-    uses: nektos/act-test-actions/.github/workflows/reusable-workflow.yml@main
+    uses: ./.github/workflows/local-reusable-workflow.yml
     with:
       string_required: string
       bool_required: ${{ true }}
@@ -24,12 +27,5 @@ jobs:
       - reusable-workflow
       - reusable-workflow-with-inherited-secrets
     steps:
-      - name: output with secrets map
-        run: |
-          echo reusable-workflow.output=${{ needs.reusable-workflow.outputs.output }}
-          [[ "${{ needs.reusable-workflow.outputs.output == 'string' }}" = "true" ]] || exit 1
-
-      - name: output with inherited secrets
-        run: |
-          echo reusable-workflow-with-inherited-secrets.output=${{ needs.reusable-workflow-with-inherited-secrets.outputs.output }}
-          [[ "${{ needs.reusable-workflow-with-inherited-secrets.outputs.output == 'string' }}" = "true" ]] || exit 1
+      - run: '[[ "${{ needs.reusable-workflow.outputs.output == ''string'' }}" = "true" ]] || exit 1'
+      - run: '[[ "${{ needs.reusable-workflow-with-inherited-secrets.outputs.output == ''string'' }}" = "true" ]] || exit 1'