The reconcile agent on the host reads this file from origin/master to decide
which image to run, so deploying and rolling back are both git operations and
no CI job ever needs a network path to the host.
The SHA is the current master revision. The agent will not act on it until an
image tagged with that SHA exists in the Gitea registry, so recording it now is
safe.
The Gitea instance is published on loopback only, and its public name
still points at an IPv4 address this host no longer has, so the runner
spent seven days failing to fetch tasks with connection refused.
Pin the name to the host's LAN address in both places act_runner needs
it: extra_hosts for the runner container, and container.options for job
and service containers so actions/checkout can clone. nginx already
serves a valid certificate for that name on the LAN address, so no
DNS, nginx, or ROOT_URL change is required, and the existing runner
registration stays valid.
