fix(ci): add --privileged to DinD and fallback IP scan for docker hostname

The docker:27-dind service container needs --privileged to start dockerd;
without it the container exits immediately and its DNS alias is removed,
causing the embedded DNS to return SERVFAIL for 'docker'.

Codeberg's act runner may also not register the service key as a network
alias at all. Add a 'Locate Docker daemon' step that tries the configured
DOCKER_HOST first, then falls back to scanning the local /24 for port 2375
so the local Dagger engine can connect to DinD regardless.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
         image: docker:27-dind
         env:
           DOCKER_TLS_CERTDIR: ""
+        options: --privileged
 
     env:
       DOCKER_HOST: tcp://docker:2375
@@ -39,6 +40,38 @@ jobs:
           DAGGER_CLIENT_KEY: ${{ secrets.DAGGER_CLIENT_KEY }}
         run: scripts/setup_dagger_remote.sh
 
+      - name: Locate Docker daemon for local Dagger engine
+        run: |
+          # Skip if remote Dagger engine is already configured
+          if [ -n "${_DAGGER_RUNNER_HOST:-}" ]; then
+            echo "Remote Dagger engine configured, no local Docker needed."
+            exit 0
+          fi
+          # Try the configured DOCKER_HOST first
+          if docker info >/dev/null 2>&1; then
+            echo "Docker available at $DOCKER_HOST"
+            exit 0
+          fi
+          # Codeberg's act runner may not register the service container with the
+          # 'docker' DNS alias.  Fall back: scan the local /24 subnet for port 2375.
+          echo "Docker unreachable via hostname; scanning network for DinD..." >&2
+          GW=$(ip route | awk '/default/{print $3; exit}')
+          PREFIX=$(echo "$GW" | cut -d. -f1-3)
+          FOUND=""
+          for i in $(seq 1 50); do
+            ip="${PREFIX}.${i}"
+            if nc -zw1 "$ip" 2375 2>/dev/null; then
+              FOUND="$ip"
+              break
+            fi
+          done
+          if [ -z "$FOUND" ]; then
+            echo "ERROR: Could not locate Docker daemon on the network" >&2
+            exit 1
+          fi
+          echo "Found Docker daemon at $FOUND:2375"
+          echo "DOCKER_HOST=tcp://$FOUND:2375" >> "$GITHUB_ENV"
+
       - name: Prune Dagger cache before check
         env:
           DAGGER_NO_NAG: "1"