Restore Docker CLI to runner image for Dagger engine

Dagger shells out to the `docker` binary to provision its BuildKit
engine container. Phase 3 removed docker-ce-cli, breaking all Dagger
calls in CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

containers/forgejo-runner/Dockerfile

@@ -4,7 +4,7 @@
 # The host runner daemon creates containers from this image to run workflow steps.
 #
 # Build logic (container images, docs site) runs inside Dagger containers,
-# so this image only needs: git, Dagger CLI, ArgoCD CLI, uv, and basic tools.
+# so this image only needs: git, Docker CLI, Dagger CLI, ArgoCD CLI, uv, and basic tools.
 #
 # Usage: Configure runner with label like:
 #   docker:docker://registry.ops.eblu.me/blumeops/forgejo-runner:latest
@@ -29,6 +29,15 @@ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
     && rm -rf /var/lib/apt/lists/* \
     && node --version
 
+# Install Docker CLI (Dagger shells out to `docker` to provision its engine)
+RUN install -m 0755 -d /etc/apt/keyrings \
+    && curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc \
+    && chmod a+r /etc/apt/keyrings/docker.asc \
+    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends docker-ce-cli \
+    && rm -rf /var/lib/apt/lists/*
+
 # Install uv (Python package runner for towncrier)
 RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
     && mv /root/.local/bin/uv /usr/local/bin/uv \

docs/changelog.d/fix-runner-docker-cli.bugfix.md

@@ -0,0 +1 @@
+Restore Docker CLI to Forgejo runner image — Dagger shells out to ``docker`` to provision its BuildKit engine.