security: verify runner listener closure and post-change CI

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

docs/forgejo-actions-runner-substrate.md

@@ -77,4 +77,21 @@ ssh coulombcore 'sudo systemctl disable --now forgejo-runner'
 ## References
 
 - `railiance-infra/docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`
-- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)
+- [Forgejo runner installation](https://forgejo.org/docs/v11.0/admin/actions/runner-installation/)
+
+## October 13 Docker listener hardening
+
+Source railiance-apps `706461b` pins the exact previously running image digests
+and binds Docker to `127.0.0.1:2375`; DinD readiness now uses a local exec ping.
+No resource, replica, registration, credential or PVC change was made. Native
+generation 4 is Ready: local ping succeeds, other-pod ping refuses and the actual
+socket is loopback only. Runner heartbeat resumed. The normal source push ran
+CI workflow 7251 successfully, including host-smoke and container-smoke.
+
+This closes the reproduced unauthenticated cross-pod daemon exposure. Host-mode
+jobs still share the privileged runner boundary; workflow authority, required
+secret checks and job credential isolation remain FORGE-WP-0006-T03 work.
+Exact proposal, retained preflight refinement and guarded rollback: Custodian
+`docs/changes/CUST-WP-0080/forge-runner-loopback-operations.md`. Native receipts:
+`docs/evidence/2026-10-13-netkingdom-security/forge-runner-loopback-activation.json`
+and `forge-runner-post-change-ci.json`.