Docs: record Phase 3 host-toolchain validation; flag registry push as blocked

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

forgerunner.src/ROADMAP.md

@@ -139,7 +139,7 @@ The project is considered successful when it can:
 
 ## Phase 3 — Docker workflow support
 
-**Status:** Planned
+**Status:** Active (host-toolchain validated; registry push pending credentials)
 
 ### Goals
 
@@ -148,16 +148,21 @@ The project is considered successful when it can:
 
 ### Tasks
 
-- [ ] Validate `actions/checkout`
-- [ ] Validate Node-based action runtime
+- [x] Validate `actions/checkout`
+- [x] Validate Node-based action runtime
 - [ ] Validate `docker/login-action`
 - [ ] Validate `docker build`
 - [ ] Validate `docker push`
 - [ ] Add support notes for self-hosted Gitea Container Registry
-- [ ] Validate mounted Docker socket usage
+- [x] Validate mounted Docker socket usage
 - [ ] Document permission expectations for `/var/run/docker.sock`
 - [ ] Evaluate `buildx` as optional enhancement
 
+### Notes
+
+- `.gitea/workflows/ci-smoke.yml` (run 110, `success`) validated on the live runner via the `host` label: `actions/checkout@v4`, bundled node/npm/git/docker versions, and Docker-socket access (`docker info`) all pass.
+- `docker/login-action` + `docker build` + `docker push` and publishing the image to `registry.alwisp.com` are blocked on registry credentials (no local docker auth, no repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`).
+
 ### Exit criteria
 
 - Standard Docker build/push workflows pass.