Avoid unreachable Gitea runner cache

docs/decap-cms-pilot.md

@@ -81,9 +81,14 @@ the pilot:
 - The existing branch preview workflows remain in place. Local output checks
   now prove preview robots rules and page metadata stay no-index and that the
   admin response has a no-index header rule.
-- Validation, preview, and production workflows cache npm's download store by
-  `package-lock.json` while retaining clean `npm ci` installs. Warm runner jobs
-  avoid repeatedly downloading the same dependency tarballs.
+- Validation, preview, and production workflows use clean `npm ci` installs with
+  `--prefer-offline --no-audit --no-fund`. Do not enable `setup-node`'s npm cache
+  until the Actions runner cache service is reachable from job containers. The
+  September 4 pilot test timed out against the runner's auto-detected private
+  address during both cache restore and cleanup. Give `act_runner` a fixed
+  `cache.host` and `cache.port` reachable from its job containers, publish that
+  port (or attach runner and jobs to a shared network), restart the runner, and
+  then restore the lockfile-keyed `cache: npm` configuration.
 
 The pilot dependencies are active: the public client ID, exact-origin CORS
 policy, `cms-pilot` branch, and both protection rules have been verified.