Docs: record Phase 3 host-toolchain validation; flag registry push as blocked

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -13,6 +13,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Phase 0 planning documents: `AGENT.md`, `README.md`, `ROADMAP.md`.
 - First successful local image build: `custom-gitea-runner:v0.1.0` (act_runner v0.2.11, Node 20, Docker CLI). Runtime smoke test passes 17/17.
 - First live registration validated against `git.alwisp.com` (Gitea 1.26.4): instance-level runner registers, comes online, runs healthy, and restart reuses the existing config without creating a duplicate.
+- `.gitea/workflows/ci-smoke.yml`: Phase 3 CI smoke workflow. Runs on the `host` label to validate the bundled toolchain (`actions/checkout@v4`, node/npm/git/docker, mounted Docker socket) directly in the runner container. First run passed.
 
 ### Fixed
 - `docker/runner/Dockerfile`: `COPY` paths for the entrypoint, healthcheck, and smoke-test scripts now resolve from the repo-root build context used by `scripts/build-image.sh` (previously assumed the build context was `docker/runner/`, so the build failed at the `COPY` steps).

forgerunner.src/ROADMAP.md

@@ -139,7 +139,7 @@ The project is considered successful when it can:
 
 ## Phase 3 — Docker workflow support
 
-**Status:** Planned
+**Status:** Active (host-toolchain validated; registry push pending credentials)
 
 ### Goals
 
@@ -148,16 +148,21 @@ The project is considered successful when it can:
 
 ### Tasks
 
-- [ ] Validate `actions/checkout`
-- [ ] Validate Node-based action runtime
+- [x] Validate `actions/checkout`
+- [x] Validate Node-based action runtime
 - [ ] Validate `docker/login-action`
 - [ ] Validate `docker build`
 - [ ] Validate `docker push`
 - [ ] Add support notes for self-hosted Gitea Container Registry
-- [ ] Validate mounted Docker socket usage
+- [x] Validate mounted Docker socket usage
 - [ ] Document permission expectations for `/var/run/docker.sock`
 - [ ] Evaluate `buildx` as optional enhancement
 
+### Notes
+
+- `.gitea/workflows/ci-smoke.yml` (run 110, `success`) validated on the live runner via the `host` label: `actions/checkout@v4`, bundled node/npm/git/docker versions, and Docker-socket access (`docker info`) all pass.
+- `docker/login-action` + `docker build` + `docker push` and publishing the image to `registry.alwisp.com` are blocked on registry credentials (no local docker auth, no repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`).
+
 ### Exit criteria
 
 - Standard Docker build/push workflows pass.