Host-side script that creates an unprivileged Debian 12 LXC, installs Node.js + act_runner in host mode, and registers it against the Gitea instance. Deploy logic lives in the repo's .gitea/workflows/deploy.yml (deploy-as-code); the runner polls outbound, so no inbound port.