runs-on docker (workflow fix)

.forgejo/workflows/grade.yml

@@ -1,19 +1,18 @@
 name: grade
 on: [push]
 
-# Production wiring (gitea-runner on ghost, docker mode):
-#   - job container = gitea/runner-images (has docker CLI) + the host docker
-#     socket, so docker_grade.sh drives the host daemon exactly as designed
+# Production wiring (forgejo-runner on ghost):
+#   - forgejo-runner v13 config sets docker_host: automount (host socket into
+#     the job container), so docker_grade.sh drives the host daemon as designed
 #   - hidden tests mount from the runner host (/opt/grade-hidden) — never in
 #     this repo
 #   - GRADE_HMAC_SECRET mounts from /opt/grade/grade.env on the runner host
 jobs:
   grade:
-    runs-on: ubuntu-latest
+    runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
       options: >-
-        -v /var/run/docker.sock:/var/run/docker.sock
         -v /opt/grade/grade.env:/run/secrets/grade.env:ro
         -v /opt/grade-hidden:/opt/grade-hidden:ro
     steps: