act_runner's defaults autodetect its own container IP as the cache
host, which per-job networks can't route to — every actions/cache
restore and save hit a 5-minute ETIMEDOUT. Add a config.yaml that
pins the cache port and advertises host.docker.internal, publish
that port on the host, and inject --add-host=host-gateway into
job containers so the hostname resolves inside isolated networks.
