docs: what a runner or nix image upgrade looks like

Both recreate the runner mid-job: the applying run shows as cancelled,
leaves its job container behind, and needs a later run to confirm.
Write the follow-up steps down where the Renovate PRs send you.

Assisted-by: Claude:opus-5-5

ansible/README.md

@@ -84,3 +84,17 @@ Always dry-run these first with `--check --diff`.
 The `nix-latest` label runs `nixos/nix:<forgejo_runner_nix_version>`
 with a `nix-store-<version>` volume over `/nix`. To bump it: change the
 variable, let the pipeline apply it, then remove the old volume.
+
+## Runner and nix image upgrades
+
+`forgejo_runner_version` and `forgejo_runner_nix_version` are bumped by
+Renovate PRs. Applying either one recreates the runner while it runs
+the very job that applies it:
+
+- that run ends as *cancelled* after everything else has been applied,
+  and its job container stays behind on asxpio-services
+  (`docker ps | grep FORGEJO-ACTIONS-TASK`); remove it;
+- the next run confirms the result. The workflow only triggers on
+  changes under `ansible/` (or `workflow_dispatch` in the web UI), so an
+  empty commit starts nothing;
+- after a nix bump, remove the old `nix-store-<old version>` volume.