# GRM-162: Add pre-cache timer, force_pull, and Docker socket options to runner config

## Problem
CI containers were not using the host's rootless Docker daemon, leading to
"no space left on device" errors. The runner config template was missing
`force_pull`, `options` (host Docker socket mount), and `valid_volumes`
fields. Additionally, no pre-cache timer existed to prevent thundering-herd
registry timeouts when all runners pull images simultaneously.

## Approach
REQ-1: Add `force_pull: false` to runner config template (explicit default
so the runner reuses locally cached images instead of pulling on every job)
REQ-2: Add `options` field to mount host rootless Docker socket as
`/run/host-docker.sock` so `start_docker.py` inside CI containers can detect
and use the host daemon (full disk, no nested DinD)
REQ-3: Add `valid_volumes` list for the socket mount targets (validated by
the runner against `container.options` and job-level volumes)
REQ-4: Add `pre_cache.yml` task with a systemd user timer that pre-pulls CI
images every 6 hours (configurable via `gitea_runner_pre_cache_schedule`)
REQ-5: Add `docker-pull-images.service.j2` and `docker-pull-images.timer.j2`
templates for the pre-cache timer
REQ-6: Timer is disabled when `gitea_runner_pre_cache_schedule` is empty or
`gitea_runner_pre_cache_images` is empty (graceful degradation)

## Test Plan
- `make lint-ci` passes (ansible-lint on new task/template files)
- `make molecule` converges successfully with the new pre-cache tasks
- Verify the runner config template renders correctly with and without
  container options/valid_volumes

## Deploy Plan
- Merge to master → post-merge auto-publishes package
- Infra dependency PR auto-created to bump pinned grm version
- Runners pick up the new config on next `make setup` or ansible apply

## Rollback Plan
- Revert the merge commit
- Set `gitea_runner_pre_cache_schedule: ""` to disable the timer without
  reverting

## Acceptance Criteria
- [x] REQ-1: `force_pull: false` in runner config template
- [x] REQ-2: `options` field mounts host Docker socket as `/run/host-docker.sock`
- [x] REQ-3: `valid_volumes` list includes both socket mount targets
- [x] REQ-4: `pre_cache.yml` task creates and manages systemd user timer
- [x] REQ-5: Service and timer templates created
- [x] REQ-6: Timer disabled gracefully when schedule or images empty