ci: run socket-free jobs on the light label

Both runners carry `light` (host1, and host2 over the wg-hosts link), so
these jobs run on whichever host is free. Jobs that mount the docker socket
keep `runs-on: docker`, which only host1 has.

.gitea/workflows/ci.yml

@@ -30,7 +30,7 @@ concurrency:
 jobs:
   # ----------------------------------------------------- license compliance --
   rust-licenses:
-    runs-on: docker
+    runs-on: light
     container:
       image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
     strategy:
@@ -44,7 +44,7 @@ jobs:
       - run: cargo deny --manifest-path "$CRATE_DIR/Cargo.toml" check licenses
 
   go-licenses:
-    runs-on: docker
+    runs-on: light
     container:
       image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
     strategy:
@@ -64,7 +64,7 @@ jobs:
             --ignore github.com/segmentio/asm
 
   npm-licenses:
-    runs-on: docker
+    runs-on: light
     container:
       image: node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 # 22-bookworm-slim
     steps:
@@ -79,7 +79,7 @@ jobs:
   # ---------------------------------------------------------- security scan --
   rust-advisories:
     needs: [rust-licenses, go-licenses, npm-licenses]
-    runs-on: docker
+    runs-on: light
     container:
       image: rust:1-bookworm@sha256:93ce27a88655056a51dbdd8f5f2d7ddc071c7b0070fb288a37b5a285fc83971e # 1-bookworm
     strategy:
@@ -94,7 +94,7 @@ jobs:
 
   go-vulncheck:
     needs: [rust-licenses, go-licenses, npm-licenses]
-    runs-on: docker
+    runs-on: light
     container:
       image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
     strategy:
@@ -112,7 +112,7 @@ jobs:
 
   npm-audit:
     needs: [rust-licenses, go-licenses, npm-licenses]
-    runs-on: docker
+    runs-on: light
     container:
       image: node:22-bookworm-slim@sha256:48e4b67d85f87bd551df43704e24d252f56cc5f8e9718841aace50f19948f0f9 # 22-bookworm-slim
     steps:
@@ -127,7 +127,7 @@ jobs:
   # bare debian.
   tenant-boundary:
     needs: [rust-advisories, go-vulncheck, npm-audit]
-    runs-on: docker
+    runs-on: light
     container:
       image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
     steps:
@@ -136,7 +136,7 @@ jobs:
 
   web-routes:
     needs: [rust-advisories, go-vulncheck, npm-audit]
-    runs-on: docker
+    runs-on: light
     container:
       image: golang:1.26-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d # 1.26-bookworm
     steps:
@@ -145,7 +145,7 @@ jobs:
 
   conformance-corpus:
     needs: [rust-advisories, go-vulncheck, npm-audit]
-    runs-on: docker
+    runs-on: light
     container:
       image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
     steps: