Phase 3 complete: docker login/build/push validated on live runner

Run 114 logged in to registry.alwisp.com, built, and pushed a test image
via the host label. Mark Phase 3 done in ROADMAP and CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

forgerunner.src/ROADMAP.md

@@ -139,7 +139,7 @@ The project is considered successful when it can:
 
 ## Phase 3 — Docker workflow support
 
-**Status:** Active (host-toolchain validated; registry push pending credentials)
+**Status:** Complete
 
 ### Goals
 
@@ -150,19 +150,20 @@ The project is considered successful when it can:
 
 - [x] Validate `actions/checkout`
 - [x] Validate Node-based action runtime
-- [ ] Validate `docker/login-action`
-- [ ] Validate `docker build`
-- [ ] Validate `docker push`
-- [ ] Add support notes for self-hosted Gitea Container Registry
+- [x] Validate `docker/login-action`
+- [x] Validate `docker build`
+- [x] Validate `docker push`
+- [x] Add support notes for self-hosted Gitea Container Registry
 - [x] Validate mounted Docker socket usage
-- [ ] Document permission expectations for `/var/run/docker.sock`
-- [ ] Evaluate `buildx` as optional enhancement
+- [x] Document permission expectations for `/var/run/docker.sock`
+- [ ] Evaluate `buildx` as optional enhancement (deferred to Phase 6)
 
 ### Notes
 
 - `.gitea/workflows/ci-smoke.yml` (run 110, `success`) validated on the live runner via the `host` label: `actions/checkout@v4`, bundled node/npm/git/docker versions, and Docker-socket access (`docker info`) all pass.
 - Image published: `registry.alwisp.com/jason/custom-gitea-runner:v0.1.0` + `:latest` (login via the jason Gitea account succeeded; push validated the registry round-trip).
-- `docker/login-action` + `docker build` + `docker push` **from a workflow** still pending: needs repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN`. Recommend a dedicated scoped package token rather than the admin API token. Corrected sample workflows (`test/sample-workflows/docker-login.yml`, `docker-build-push.yml`) are ready to run on the `host` label once the secrets exist.
+- `docker/login-action` + `docker build` + `docker push` **from a workflow** validated: `.gitea/workflows/docker-push.yml` (run 114, `success`) logged in to `registry.alwisp.com`, built, and pushed a test image; the artifact was confirmed in the registry then cleaned up.
+- Repo Action secrets `REGISTRY_USER`/`REGISTRY_TOKEN` are set (currently the admin API token — replace with a dedicated `write:package`-scoped token when convenient).
 
 ### Exit criteria