Self-hosted incremental-build runner: job containers get the host Docker socket #5696

Follow-up to #5682 (see the review comment there on incremental-build.yml:50: #5682 (comment)).

The Actions runner mounts /var/run/docker.sock into every Linux job container, and the incremental-build job runs as root. Removing --privileged (#5682) does not remove this mount, and nothing in the workflow's options: or volumes: can remove it.

This needs a change on the runner host, not in this repo. Options:

• container hooks (ACTIONS_RUNNER_CONTAINER_HOOKS) that create the job container without the socket and as a non-root user
• a rootless or userns-remapped Docker daemon
• ephemeral runners

Needs the runner admins. Related: running the job as non-root (#5698).