feat: Add opt-in APT cache support for ephemeral runners and Docker builds #87

Goal

Allow a controller host to provide an optional HTTP APT proxy or cache to its ephemeral runner containers and to Docker builds started by those runners. The repository must not contain a site-specific proxy address.

Observed gap

Host APT configuration does not cross the Docker boundary. The controller currently creates each runner with its GitHub JIT configuration and the Docker socket mount. The runner has no runtime APT proxy configuration, and its Docker client has no proxy configuration.

As a result, APT commands on the host can use a cache while APT commands inside runner jobs and Docker build stages go directly to upstream repositories.

Required behavior

• Add optional host-local settings in /etc/ci-fleet/host.env, such as CI_FLEET_APT_HTTP_PROXY and CI_FLEET_NO_PROXY. Keep the real endpoint out of Git-authored desired state.
• When configured, give each ephemeral runner an APT configuration containing Acquire::http::Proxy.
• Keep HTTPS APT repositories direct with Acquire::https::Proxy "DIRECT".
• Configure the runner's Docker client or BuildKit path so HTTP requests from Docker build stages can use the same proxy. Do not configure an HTTPS proxy.
• Validate the proxy URL and reject embedded credentials, control characters, and malformed values.
• Do not print the proxy value in logs, health reports, rendered evidence, or status output.
• Preserve current behavior when the setting is absent. New runners must contain no generated proxy configuration after the setting is removed.
• Document that this feature is for trusted private runner pools because jobs can inspect their runtime network configuration.

Acceptance tests

• Enabled, disabled, removed, and invalid configurations are covered.
• A disposable runner completes apt-get update through a test APT cache.
• A Docker build started inside that runner completes apt-get update through the same cache.
• HTTPS repository traffic remains direct.
• No endpoint, credential, or private infrastructure identifier is committed or logged.
• Existing runner lifecycle, scale-to-zero behavior, cleanup, and rollback remain unchanged when the feature is disabled.

Non-goals

• No hardcoded proxy or cache endpoint.
• No global Docker daemon proxy change.
• No project-specific workflow logic.
• No deployment or controller-host change as part of this issue.