Use the system Docker socket in backend CI (#321)

## Summary
- Keep untrusted PRs on ephemeral Ubuntu runners and trusted pushes on
the local backend pool.
- Force Docker-dependent jobs to the working system socket instead of
the unavailable default rootless context.
- Preserve the fail-closed Docker access check and never chmod the
socket.

## Evidence
- Exact master run 29942048689 failed before tests because plain Docker
commands resolved to `/run/user/1000/docker.sock`.
- Backend listener processes already have docker-group membership;
`/var/run/docker.sock` is root:docker 0660.
- `DOCKER_HOST=unix:///var/run/docker.sock docker version` succeeds
locally with server 29.3.1.
- Workflow YAML parse and `git diff --check` pass.

Exact-master Required CI and Release Manager gate success remain
mandatory after merge.

.github/workflows/tests.yml

@@ -19,14 +19,14 @@ concurrency:
 jobs:
   php:
     name: PHP ${{ matrix.suite }} (required)
-    # Pull requests are untrusted and must use an ephemeral GitHub-hosted runner.
-    # Trusted branch pushes may use the local backend pool for throughput.
+    # Pull requests are untrusted and use ephemeral runners; trusted pushes use the local pool.
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
     strategy:
       fail-fast: false
       matrix:
         suite: [unit, integration, api, legacy]
     env:
+      DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_PROJECT_NAME: php-${{ github.run_id }}-${{ github.job }}-${{ matrix.suite }}-${{ github.run_attempt }}
 
     steps:
@@ -116,6 +116,8 @@ jobs:
   edge-broker:
     name: Edge Broker (required)
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
+    env:
+      DOCKER_HOST: unix:///var/run/docker.sock
 
     steps:
       - name: Checkout
@@ -159,6 +161,7 @@ jobs:
     name: Edge Gateway Backend (required)
     runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'backend' }}
     env:
+      DOCKER_HOST: unix:///var/run/docker.sock
       COMPOSE_FILE: docker-compose.yml:.github/docker-compose.ci.yml
       COMPOSE_PROJECT_NAME: edge-gateway-backend-${{ github.run_id }}-${{ github.run_attempt }}
       COMPOSE_PROFILES: dev