fix(ci): derive DOCKER_HOST from the job container's own default gateway

--add-host=host.docker.internal:host-gateway is not being honored by
this act_runner setup (tried via the runner's global container.options
and a per-job container: block; neither worked, confirmed by two
separate failed runs with identical DNS-lookup errors). Read the
container's real default-route gateway from /proc/net/route instead
(portable, no iproute2 dependency) and export it as DOCKER_HOST via
GITHUB_ENV. This is the actual IP of the dind engine that spawned the
job container, regardless of hostname-aliasing support.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.forgejo/workflows/build.yaml

@@ -13,17 +13,7 @@ concurrency:
 jobs:
   build:
     runs-on: docker-ready
-    # Explicit container: (rather than relying only on the docker-ready
-    # label mapping) so job-level container options are reliably honored.
-    container:
-      image: ci.nxtgauge.com/admin/forgejo-runner-job:bookworm
-      options: --add-host=host.docker.internal:host-gateway
     env:
-      # 127.0.0.1 doesn't work here: the job container is nested one level
-      # inside the runner pod's dind sidecar, so its own loopback isn't the
-      # sidecar's. host.docker.internal (mapped via --add-host above)
-      # reaches back to the dind engine that actually spawned this container.
-      DOCKER_HOST: tcp://host.docker.internal:2375
       DOCKER_BUILDKIT: "1"
     steps:
       - name: Checkout
@@ -31,6 +21,24 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Point DOCKER_HOST at this container's own gateway
+        run: |
+          set -euo pipefail
+          # 127.0.0.1 doesn't work: the job container is nested one level
+          # inside the runner pod's dind sidecar, so its own loopback isn't
+          # the sidecar's. --add-host=host.docker.internal:host-gateway is
+          # not being honored by this runner (tried via both global
+          # container.options and a per-job container: block — neither
+          # resolved), so read the container's actual default-route gateway
+          # directly instead, which is the dind engine that spawned it.
+          # Read directly from /proc/net/route instead of relying on the `ip`
+          # or `route` CLI tools being installed in the job image.
+          GATEWAY="$(awk '$2 == "00000000" {print $3}' /proc/net/route | head -1 | \
+            sed -E 's/(..)(..)(..)(..)/0x\4 0x\3 0x\2 0x\1/' | \
+            { read -r a b c d; printf '%d.%d.%d.%d' "$a" "$b" "$c" "$d"; })"
+          echo "Detected docker host gateway: $GATEWAY"
+          echo "DOCKER_HOST=tcp://$GATEWAY:2375" >> "$GITHUB_ENV"
+
       - name: Detect changed services
         run: |
           set -euo pipefail