Support sibling Docker daemons in Gitea package builds

packaging/NOTES.md

@@ -78,8 +78,11 @@ and udev installation, macro help/version and purge cleanup. Source rebuilds
 install newly rebuilt dependencies, not binaries from the first build.
 
 Gitea CI (`.gitea/workflows/debian.yml`) builds on every push to `main` and
-manual dispatch, using an `ubuntu-latest` runner with local Docker Engine.
-The runner must expose the same workspace paths to Docker for read-only mounts.
+manual dispatch, using an `ubuntu-latest` runner with Docker Engine access.
+`ci.sh` copies only the build-input allowlist into disposable containers instead
+of bind-mounting runner paths, supporting containerized runners with sibling
+Docker daemons. The standalone rebuild receives only artifacts and its script.
+Containers are removed on exit; their exit codes are explicitly checked.
 It uploads `debian13-amd64` artifacts using the Gitea-compatible v3 protocol;
 download the artifact from the successful run and check `SHA256SUMS`.
 Gitea does not run the GitHub CLI release job or publish release assets.