Pin cached Gitea workflow actions

docs/decap-cms-gitea-setup.md

@@ -29,6 +29,27 @@ If Cloudflare later assigns a different stable origin,
 update the repository configuration, CORS origin, and OAuth redirect URI
 together through review before enabling login.
 
+## Runner cache settings
+
+The Dockerized runner uses a persistent `/data` volume and the same dedicated
+Docker network as its job containers. Its non-confidential cache settings are:
+
+```yaml
+cache:
+  enabled: true
+  dir: /data/cache
+  host: sloanops-gitea-runner
+  port: 8088
+  offline_mode: true
+container:
+  network: sloanops-actions
+```
+
+`offline_mode` is safe here because every external `uses:` reference is pinned
+to a reviewed full commit SHA. It prevents the runner from refreshing mutable
+action branches on every job; npm packages remain keyed separately by
+`package-lock.json` through setup-node's cache integration.
+
 ## Applied CORS policy
 
 The tracked Gitea service in