forgejo-runner: match the live runner and pin the nix image

The role had drifted from what runs on asxpio-services: capacity 4,
a bridge network per workflow so service containers start, the Docker
socket automounted into jobs, and a nix-latest label backed by a
persistent nix-store volume.

That volume caused a CI outage on 2026-10-18. nixos/nix:latest moved on,
and since the image's /bin/sh and /etc/nix/nix.conf link into /nix/store,
the old volume left them dangling. Pin the image through
forgejo_runner_nix_version and name the volume after it, so a bump is
deliberate and always gets a store seeded from its own image.

Assisted-by: Claude:opus-5-5

ansible/roles/forgejo_runner/templates/config.yaml.j2

@@ -28,6 +28,7 @@ runner:
     - "python-3.11:docker://python:3.11"
     - "python-3.12:docker://python:3.12"
     - "alpine-latest:docker://alpine:latest"
+    - "nix-latest:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
 
 cache:
   enabled: true
@@ -35,9 +36,13 @@ cache:
   dir: ""
 
 container:
-  network: "host"
+  # "" so each workflow gets a bridge network; services (Postgres) need it.
+  network: ""
   enable_ipv6: false
   privileged: false
-  docker_host: "-"
+  options: "-v nix-store-{{ forgejo_runner_nix_version }}:/nix"
+  valid_volumes:
+    - '**'
+  docker_host: "automount"
   force_pull: false
   force_rebuild: false