Uses archive checkout + static docker-cli (non-root host runner pattern). Pushes to forgejo.coulomb.social/coulomb/key-cape per RAIL-HO-WP-0005-T10.