Fix act_runner: add :z SELinux label to Docker socket mount

SELinux in enforcing mode blocks container access to the Docker
socket. The :z flag relabels the socket for shared container access.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yaml

@@ -69,7 +69,7 @@ services:
     user: "0:0"
     volumes:
       - act_runner_data:/data
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:z
     environment:
       - DOCKER_HOST=unix:///var/run/docker.sock
       - GITEA_INSTANCE_URL=https://git.sentinelforest.xyz