ci docs: the shared daemon is per runner (runner-a1 runs several jobs at once)

Task logs of run 740: runner-a1 received task 2721 (smoke-studio) at
22:53:02Z and task 2722 (build-variant) at 22:58:38Z while 2721 was still
running. Other runners (runner-1/2/3) have capacity 1. 12e66aa said all
jobs share one daemon; corrected in CHANGELOG, AGENTS.md, the script
header and the lint.yml comment. No behaviour change.

.gitea/workflows/lint.yml

@@ -91,7 +91,8 @@ jobs:
         run: bash scripts/check-workflow-shell.sh .gitea/workflows
 
       - name: No raw docker prune in workflows (shared runner daemon)
-        # Every docker-publish.yml job shares the runner's Docker daemon, and
+        # Jobs on the same runner share its Docker daemon (runner-a1 runs
+        # several docker-publish.yml jobs at once), and
         # a bare `docker system prune -a` in one job deletes the smoke image
         # another job is testing (v1.12.2 run 740 shipped without its -studio
         # tags that way). Reclaim goes through scripts/ci-reclaim-docker.sh,

AGENTS.md

@@ -45,8 +45,8 @@ re-brand of opencode-devbox's `pi-only` variant.
   update-description). The `-studio` variant adds independent
   `smoke-studio` + `build-variant-studio` jobs that gate only the
   `-studio` tags (never the core `:latest` release).
-- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. All jobs
-  share the runner's Docker daemon, so a bare `docker system prune -a` in one
+- `scripts/ci-reclaim-docker.sh` — the ONLY way a CI job frees disk. Jobs on
+  the same runner share its Docker daemon (runner-a1 runs several at once), so a bare `docker system prune -a` in one
   job deletes the smoke image another job is mid-test on (v1.12.2 run 740 lost
   its `-studio` tags that way). The script spares images labelled
   `se.jordbo.pi-devbox.ci-smoke-image`; the smoke jobs apply that label,

CHANGELOG.md

@@ -17,8 +17,9 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 - **CI: a smoke job's image could be deleted mid-test by another job's disk
   reclaim.** This is why v1.12.2's `-studio` tags were not published by its
-  tag run. All `docker-publish.yml` jobs share the runner's Docker daemon, and
-  each began with `docker system prune -af --volumes`, which removes every
+  tag run. Jobs that land on the same runner share its Docker daemon (in run
+  740, runner-a1 ran `smoke-studio` and `build-variant` at the same time), and
+  each job began with `docker system prune -af --volumes`, which removes every
   image that no container is using at that moment. A smoke image is unused
   between `smoke-test.sh`'s one-shot `docker run`s. In run 740, `smoke`
   passed and `build-variant` started. Its prune logged

scripts/ci-reclaim-docker.sh

@@ -9,8 +9,10 @@
 #   bash scripts/ci-reclaim-docker.sh assert-protected IMG  # smoke preflight
 #   bash scripts/ci-reclaim-docker.sh lint WORKFLOW...      # lint.yml guard
 #
-# WHY THIS EXISTS. The jobs share ONE Docker daemon (the runner's socket), and
-# each used to start with `docker system prune -af --volumes`. That removes
+# WHY THIS EXISTS. Jobs that land on the same runner share its Docker daemon
+# (runner-a1 runs several at once: in run 740 it had smoke-studio and
+# build-variant going together), and each job used to start with
+# `docker system prune -af --volumes`. That removes
 # every image no container is using at that instant, and a smoke image is
 # exactly that for most of its life: smoke-test.sh runs one `docker run --rm`
 # per assertion, so between assertions nothing holds the image. v1.12.2 run 740