fix(ci): support ipset sockets and deployed image smoke checks

scripts/bench/runtime.sh

@@ -7,9 +7,11 @@ out="${2:?OUTPUT_DIR required}"
 mkdir -p "$out"
 id="evofw-bench-$(date +%s)-$$"
 volume="$id-data"
+load_id="$id-load"
 cleanup() {
   docker logs "$id" >"$out/container.log" 2>&1 || true
   [ -z "${sampler:-}" ] || { kill "$sampler" 2>/dev/null || true; wait "$sampler" 2>/dev/null || true; }
+  docker rm -fv "$load_id" >/dev/null 2>&1 || true
   docker rm -f "$id" >/dev/null 2>&1 || true
   docker volume rm "$volume" >/dev/null 2>&1 || true
 }
@@ -20,7 +22,7 @@ docker image inspect "$image" >"$out/image.json"
 if docker volume inspect "$volume" >/dev/null 2>&1; then echo 'Refusing reused benchmark volume' >&2; exit 1; fi
 docker volume create "$volume" >/dev/null
 started="$(date +%s)"
-docker run -d --name "$id" --cpus 2 --memory 4g --publish 127.0.0.1::8080 \
+docker run -d --name "$id" --cpus 2 --memory 4g --network none \
   --mount "type=volume,src=$volume,dst=/data" -e EVOFW_ALLOW_UNSAFE=true -e AUTH_REQUIRED=false "$image" >/dev/null
 attempts=0
 until docker exec "$id" node -e "fetch('http://127.0.0.1:8080/ready').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))" >/dev/null 2>&1; do
@@ -31,8 +33,24 @@ docker exec -i "$id" node --input-type=module <scripts/bench/fixture.mjs >"$out/
 # Includes CPU, memory, block IO and PIDs. Metrics are raw observations, no claimed gains.
 (while docker inspect -f '{{.State.Running}}' "$id" 2>/dev/null | grep -q true; do docker stats --no-stream --format '{{json .}}' "$id"; sleep 1; done) >"$out/stats.jsonl" &
 sampler=$!
-port="$(docker port "$id" 8080/tcp | sed 's/.*://')"
-BENCH_P95_LIMIT_MS="${BENCH_P95_LIMIT_MS:-500}" BENCH_URL="http://127.0.0.1:$port" node scripts/bench/load.mjs >"$out/load.json" || load_failed=true
+# The daemon can be remote or reached from a Gitea job container: runner
+# localhost is not the API container. A separate nonroot driver joins only the
+# API network namespace, so its CPU work is outside the app's 2-CPU quota.
+docker create --name "$load_id" --network "container:$id" \
+  --user 65534:65534 --cap-drop ALL --security-opt no-new-privileges:true \
+  --pids-limit 128 --cpus 2 --memory 1g --entrypoint node \
+  -e BENCH_URL=http://127.0.0.1:8080 \
+  -e "BENCH_P95_LIMIT_MS=${BENCH_P95_LIMIT_MS:-500}" \
+  -e "BENCH_CONCURRENCY=${BENCH_CONCURRENCY:-10}" \
+  -e "BENCH_STEADY_CONCURRENCY=${BENCH_STEADY_CONCURRENCY:-2}" \
+  -e "BENCH_STEADY_INTERVAL_MS=${BENCH_STEADY_INTERVAL_MS:-1200}" \
+  "$image" /tmp/load.mjs >/dev/null
+# docker cp transfers bytes through the Docker API; no runner bind mount or
+# container Docker socket is needed. Both modules are readable by the driver UID.
+docker cp scripts/bench/load.mjs "$load_id:/tmp/load.mjs"
+docker cp scripts/bench/fixture.mjs "$load_id:/tmp/fixture.mjs"
+docker start --attach "$load_id" >"$out/load.json" || load_failed=true
+[ "$(docker wait "$load_id")" = 0 ] || load_failed=true
 cat "$out/load.json"
 docker exec "$id" sh -c 'ls -ln /data/app.db*; cat /proc/1/status; cat /proc/1/io' >"$out/db-process.txt"
 sh deploy/docker/backup.sh "$id" "$out/backup.db"