ci: mount the docker socket so the testcontainers suite can run

cm-files' s3_store test starts a real MinIO via testcontainers. Without the
socket it does not skip — it fails with
`Client(Init(SocketNotFoundError("/var/run/docker.sock")))`, which looks like a
broken test rather than a missing capability. It passed locally only because the
Mac's docker socket was visible to the test process.

Sibling containers testcontainers starts are reachable because the test
container already shares the host network.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitea/workflows/deploy.yml

@@ -50,6 +50,12 @@ jobs:
       # Rust lives in a container because gw-04 has no cargo. The named volumes
       # are the whole reason this is not painfully slow: without them every run
       # recompiles the world.
+      # The docker socket is mounted because cm-files' s3_store test uses
+      # testcontainers to spin up a real MinIO. Without it the test does not skip
+      # — it fails with SocketNotFoundError, which reads like a broken test
+      # rather than a missing capability. Sibling containers it starts are
+      # reachable because this container shares the host network.
+      #
       # `cargo test --workspace` builds cm-brain, which pulls clawhdf5 from
       # git.redclaw.dev — a PRIVATE repo. Two things are needed and neither is
       # optional:
@@ -65,6 +71,7 @@ jobs:
             -v cm-ci-cargo-registry:/usr/local/cargo/registry \
             -v cm-ci-cargo-git:/usr/local/cargo/git \
             -v cm-ci-target:/w/target \
+            -v /var/run/docker.sock:/var/run/docker.sock \
             -e SQLX_OFFLINE=true \
             -e CARGO_NET_GIT_FETCH_WITH_CLI=true \
             -e FORGE_TOKEN='${{ secrets.FORGE_TOKEN }}' \