fix(ci-cd): cap job container memory/cpu to protect weak Gitea host (1.6G)

deploy/ci/runner/config.yaml

@@ -21,6 +21,8 @@ container:
   workdir_parent: /opt/act_runner/work
   valid_volumes:
     - /var/run/docker.sock
+  # 资源保护：147 仅 1.6G 内存/2 核，job 必须限内存，否则 OOM 拖垮宿主机
+  options: "--memory=1g --memory-swap=1g --cpus=1.5"
   # options: --add-host git.solahqb22.cn:host-gateway   # 仅当 EIP hairpin 不通时启用（见计划 6.4）
 host:
   workdir_parent: ""