The Gitea runner executes jobs inside a container. Port-mapped services
bind to the host VM's interface, not to the runner container's loopback,
so localhost:<port> is always unreachable regardless of services: config.
--network container:$(hostname) joins each service to the job container's
network namespace, making both accessible on localhost. Both DB URL and
S3 endpoint use localhost accordingly.
Also adds timeout-minutes: 15 to bound runaway jobs on cancel.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>