Close 5 documented gaps + safer Docker-socket alternative to DinD

[Athenox14]

Summary

Addresses the 5 gaps listed under DOC.md §14 "Known limitations", plus research into a safer alternative to the current Docker-socket-mount setup (not actual DinD, but the same risk shape).

• Full-text/code search: search(query) now runs real SQLite FTS5 (MATCH, BM25 ranking) instead of substring LIKE, covering repositories/issues/users, plus a new code search (SearchResults.code) indexed from each repo's default branch after every push.
• Repo rename-on-disk: new renameRepository(repoId, newName) mutation moves the bare repo + wiki directory on disk and updates the DB name, with best-effort rollback on partial failure.
• Pre-receive hook backfill: new admin mutation adminBackfillPreReceiveHooks writes the branch-protection hook onto every existing repo, not just newly-created ones.
• GitHub Actions marketplace: uses: now supports docker://image, owner/repo[/path]@ref docker actions (including building from a Dockerfile), one level of composite actions, and node12/16/18/20 JS actions (run in a dedicated node:*-slim helper container). Unsupported cases still degrade to the existing "not supported, skipping" log rather than failing the job.
• Standalone runner dev-workspace hosting: the runner now claims and executes dev_workspace_action jobs (create/delete/exec) against its own Docker daemon; createDevWorkspace gained an onRunner flag. Start/stop and live port-proxying for runner-hosted workspaces are documented as remaining gaps (no reverse tunnel between runner and server yet).
• Safer alternative to the Docker-socket mount: DOCKER_SOCKET_PATH is now actually wired into bollard (previously accepted but ignored), so deployments can point it at a rootless Podman socket or a Sysbox-isolated daemon instead of bind-mounting the host's own Docker socket. Documented in DOC.md §2a with the research behind the recommendation.

All five bullets from the old DOC.md §14 list are now either resolved or replaced with a narrower, honestly-documented residual gap.

Test plan

• cargo check --workspace clean
• cargo test --workspace — all pass except 6 pre-existing integration tests that construct a Docker client, which fail in this sandbox only because there's no /var/run/docker.sock (no dockerd available here); confirmed unrelated to this change (same Executor::new()/connect_local() call as before, untouched).
• New unit tests: 6 for actions::marketplace (ref parsing, input resolution/substitution), 2 for git-core (rename with rollback/collision, hook backfill idempotence).
• Recommend a real end-to-end smoke test against a live Docker daemon (marketplace docker/node actions, runner-hosted workspace create/delete/exec) before relying on this in production, since the sandboxed dev environment here has no Docker daemon to exercise those paths live.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PQ5ctde43ucFvCaeoeEvPK

---

Generated by Claude Code