ci: distinguish why the QA build daemon is unreachable (#25)

The first dispatch failed at the wait step with nothing to act on. The
run logs showed the dind service container was never created — no service
startup output at all, and teardown reporting "No such container" for the
ID it had recorded — which is what act_runner does when it refuses a
privileged container.

From the failing step, that is indistinguishable from dockerd simply
being slow, so the step now says which one it is: if the service host
resolves, the container exists and dockerd is not serving plain TCP on
2375; if it does not resolve, the service never started and the runner
needs container.privileged.

Also raises the wait from 30s to 90s. The NAS took the full 30s before
failing, so the old ceiling was too close to the observed time to
distinguish slow from broken.

The docker CLI fallback is retained: the runner image has no docker
binary, and the static install worked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.gitea/workflows/qa-build.yml

@@ -70,19 +70,35 @@ jobs:
 
       - name: Wait for the build daemon
         run: |
-          # A privileged service container is the one runner capability this
-          # workflow cannot verify in advance. Fail here with an explanation
-          # rather than at `docker build` with a connection refused.
-          for i in $(seq 1 30); do
+          # dind needs a privileged service container, which is a runner-wide
+          # setting this workflow cannot check in advance. The NAS is also slow
+          # to start one, so allow well over the observed time before giving up.
+          for i in $(seq 1 90); do
             if docker info >/dev/null 2>&1; then
               echo "Build daemon reachable after ${i}s."
               exit 0
             fi
             sleep 1
           done
-          echo "::error::No Docker daemon at $DOCKER_HOST after 30s."
-          echo "The dind service needs privileged containers. If the runner"
-          echo "forbids them, this workflow cannot build without host socket access."
+
+          echo "::error::No Docker daemon at $DOCKER_HOST after 90s."
+          echo ""
+          # These two cases look identical from the failing step but have
+          # completely different fixes, so name which one it is.
+          if getent hosts docker >/dev/null 2>&1; then
+            echo "The 'docker' service host resolves, so the container exists but"
+            echo "dockerd is not accepting connections on 2375. Check that"
+            echo "DOCKER_TLS_CERTDIR is empty, so dind serves plain TCP rather"
+            echo "than TLS on 2376."
+          else
+            echo "The 'docker' service host does not resolve, so the service"
+            echo "container never started. This is what act_runner does when it"
+            echo "refuses a privileged container: it allocates an ID, creation"
+            echo "fails, and the job continues with nothing listening."
+            echo ""
+            echo "Set 'container.privileged: true' in the act_runner config.yaml"
+            echo "and restart the runner. Check the runner's own logs to confirm."
+          fi
           exit 1
 
       - name: Record what is being built