CUST-WP-0054-T04: record image-build CI proof on railiance01 runner

Documents successful forgejo-actions-probe image-build workflow (static
docker-cli + DinD, org registry secrets) and notes remaining repo migration
work before workstation-off release.

docs/forgejo-production-decisions.md

@@ -15,7 +15,7 @@ Operator input: 2026-07-03
 | 3 | Gitea during transition | `gitea.coulomb.social` on coulombcore remains canonical **until** Forgejo restore/migration drills pass; then read-only mirror | unchanged | Per `RAIL-HO-WP-0005` safety contract |
 | 4 | SMTP / password reset | TBD | open | — |
 | 5 | Package registry scope | TBD (container images first assumed) | open | — |
-| 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **decided** | `railiance-infra/docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md`; manifests in `railiance-apps/manifests/forgejo-runner.yaml` |
+| 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **done** (2026-07-03) | Runner 2/2 Ready; coulombcore host runner disabled; `image-build` probe pushed OCI image via org secrets |
 | 7 | Backup target + retention | TBD | open | — |
 | 8 | Cutover mode | TBD (staged per-repo vs freeze-all) | open | — |
 
@@ -49,8 +49,8 @@ remains canonical for git remotes until migration drills pass.
   CI `IMAGE_REPOSITORY` variables.
 - State Hub / sweep checkouts on railiance01 (T05) should clone from
   `forgejo.coulomb.social` once cutover completes.
-- Remaining T02 items (SMTP, runners, backup, cutover mode) still block
-  production cutover and `RAIL-HO-WP-0005-T11`.
+- Runners and image-build CI are proven; remaining blockers for production
+  cutover: SMTP, backup, cutover mode, and repo migration (`RAIL-HO-WP-0005-T11`).
 
 ## Open decisions (need operator input)