The Gitea instance is published on loopback only, and its public name
still points at an IPv4 address this host no longer has, so the runner
spent seven days failing to fetch tasks with connection refused.
Pin the name to the host's LAN address in both places act_runner needs
it: extra_hosts for the runner container, and container.options for job
and service containers so actions/checkout can clone. nginx already
serves a valid certificate for that name on the LAN address, so no
DNS, nginx, or ROOT_URL change is required, and the existing runner
registration stays valid.
