[chore](trx-rs): add OpenRC service for act_runner on Alpine

The runner host is Alpine (OpenRC, no systemd). Add an OpenRC init script
for act_runner (supervise-daemon, depends on docker) plus a conf.d
example for running one instance per project, and rewrite the runner
section of the README with Alpine setup steps (apk docker, dedicated user
in the docker group, register, service install).

Assisted-By: Claude Code (claude-opus-4)
Claude-Session: https://claude.ai/code/session_01NFpGtGTWUEYXLwZeZs2RAV
Signed-off-by: Stan Grams <sjg@haxx.space>

container/README.md

@@ -54,25 +54,61 @@ The `reuse` job stays on the upstream `fsfe/reuse-action` (a Docker action the
 Docker executor launches as a sibling container) — nothing REUSE-related is
 baked into the SDK.
 
-## CI runner (VM)
+## CI runner (Alpine / OpenRC)
 
-The runner runs in a small VM using the **Docker executor** (not the host
-executor). This gives per-job container isolation and standard `ubuntu-latest`
-semantics, and caps CI resources at the VM boundary.
+The runner uses the **Docker executor** (not the host executor): per-job
+container isolation and standard `ubuntu-latest` semantics. `act_runner` runs
+as an OpenRC service. Files provided:
 
-1. **Size the VM to your thread budget.** 2 vCPUs = a hard 2-thread ceiling.
-   Pin them to specific host threads so CI never touches the rest (libvirt/KVM):
+| File | Purpose |
+|------|---------|
+| `act_runner.openrc` | OpenRC init script (`supervise-daemon`, depends on docker). |
+| `act_runner.confd.example` | Per-instance `conf.d` settings for multi-runner hosts. |
 
-   ```xml
-   <vcpu placement='static'>2</vcpu>
-   <cputune>
-     <vcpupin vcpu='0' cpuset='4'/>
-     <vcpupin vcpu='1' cpuset='5'/>
-   </cputune>
-   ```
+**Cap the thread budget.** In a VM, pin its vCPUs to specific host threads
+(libvirt/KVM):
 
-2. **Inside the VM:** install Docker (moby) and `act_runner`.
-3. **Register one runner per project** (separate tokens from each repo's
-   *Settings → Actions → Runners*; scope keeps their jobs apart).
-4. **Configure** with `runner-config.example.yaml` — `capacity: 1` and
-   `container.options: "--cpus=2"` keep usage inside the 2-thread budget.
+```xml
+<vcpu placement='static'>2</vcpu>
+<cputune>
+  <vcpupin vcpu='0' cpuset='4'/>
+  <vcpupin vcpu='1' cpuset='5'/>
+</cputune>
+```
+
+On bare metal, the `container.options: "--cpus=2"` and `capacity: 1` in
+`runner-config.example.yaml` already bound each runner.
+
+**Set it up:**
+
+```bash
+# 1. Docker + a dedicated user with socket access
+apk add docker docker-cli
+rc-update add docker default && rc-service docker start
+adduser -S -D -H -h /var/lib/act_runner act
+addgroup act docker
+
+# 2. act_runner binary (static Go build, works on musl)
+curl -fsSL -o /usr/local/bin/act_runner \
+  https://gitea.com/gitea/act_runner/releases/download/v0.2.11/act_runner-0.2.11-linux-amd64
+chmod +x /usr/local/bin/act_runner
+
+# 3. Config + register one runner per project (scope keeps their jobs apart)
+install -Dm644 container/runner-config.example.yaml /etc/act_runner/trx-rs.yaml
+install -d -o act /var/lib/act_runner/trx-rs
+su act -s /bin/sh -c 'cd /var/lib/act_runner/trx-rs && \
+  act_runner register --no-interactive \
+    --instance https://git.haxx.space --token <TOKEN> \
+    --name trx-rs-ci \
+    --labels "ubuntu-latest:docker://catthehacker/ubuntu:act-latest"'
+
+# 4. OpenRC service (repeat the symlink+conf.d for the second project)
+install -m755 container/act_runner.openrc /etc/init.d/act_runner
+ln -s act_runner /etc/init.d/act_runner.trx-rs
+install -m644 container/act_runner.confd.example /etc/conf.d/act_runner.trx-rs
+rc-update add act_runner.trx-rs default
+rc-service act_runner.trx-rs start
+```
+
+Check it with `rc-service act_runner.trx-rs status` and
+`tail -f /var/log/act_runner.trx-rs.log`.