Isolate Forgejo runner action caches and repair runner registration

CI task 5024 (client-tests) failed before checkout while fetching actions/checkout@v4: shallow.lock collision in /home/runner/.cache/act/87/7ac8e046e4e302867568015979cf38c7311aa10e947661460f22081473ddd8 on git-prk-server. Verified investigation: runner-03 and runner-04 (v13.2.0) both accepted tasks 5023/5024 at 2026-10-06 18:15:47 UTC. The shared cache shallow file was updated at 18:15:48 while client job failed on its lock; lock no longer exists. Both services use HOME=/home/runner despite distinct WorkingDirectory and XDG_CACHE_HOME settings. Only /home/runner/.cache/act exists; cache.dir config isolates workflow artifact caches, not downloaded action Git repositories. Evidence strongly indicates concurrent fetch collision, not a persistent stale lock or client-code failure. Separate issues: forgejo-runner-02 is unregistered and restart-looping every 10 seconds (over 48,000 restarts). All configs specify a public_files volume allowlist that rejects the exact directory mount, producing a nonfatal warning. Scope: choose and verify supported isolation of downloaded action repositories per runner; repair/re-register or disable obsolete runner-02; correct volume allowlist if that mount is intended. Cache isolation applied on 2026-10-06 18:25 UTC: v13.2.0 source confirms internal/app/run/runner.go sets ActionCacheDir from cfg.Host.WorkdirParent; its default overrides the XDG_CACHE_HOME fallback. Added explicit host.workdir_parent values /home/runner/runner-03/.cache/act and /home/runner/runner-04/.cache/act to /srv/forgejo/runner-03-config.yml and runner-04-config.yml. Timestamped backups retained alongside configs. Stopped and restarted both services; shutdown logs confirmed zero running tasks, both declared successfully and are active. No stale Git locks were present. Runner-02 registration and volume warning remain unchanged. Concurrent CI rerun validation is pending; do not mark cache checklist complete until verified. Acceptance: simultaneous engine/client jobs complete action preparation without Git lock collisions; runner-02 no longer restart-loops; intended volume mounts are accepted. Validate actual concurrent CI rerun after configuration changes.