- RUNNER_TOKEN env for act_runner registration (separate from GITEA_TOKEN)
- Create /opt/runner/work as workdir_parent (fixes .cache path error)
- Runner config via .runner.yaml with explicit workdir
- IMDSv2 for instance metadata
- PATH includes /usr/local/go/bin