docs: record why this repo must stay public

Correcting a wrong claim in the previous commit: sharing an owner with
the caller does not grant read access to a private callee. act_runner
clones the reusable workflow anonymously, so the repo has to be public.

Also notes the act cache key, which hid this for months, and the stale
Dubrowski bot identity.

README.md

@@ -37,7 +37,9 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated
 
 MediaWiki BotPassword issued for user `Mikkeli`, bot name `giteaBot`. Login form: `Mikkeli@giteaBot`.
 
-Both this and the previous `Dubrowski` identity hold the `bot` right, so pipeline edits stay flagged as bot edits and keep out of default Recent Changes — `mwclient`'s `page.save()` requests the bot flag and the wiki honours it.
+`Mikkeli` holds the `bot` right, so pipeline edits are flagged as bot edits and stay out of default Recent Changes — `mwclient`'s `page.save()` requests the bot flag and the wiki honours it.
+
+This section previously named `Dubrowski@giteaAutomaton`, but every bot-flagged revision in the wiki's history is attributed to `Mikkeli`, so that had been stale for some time — the live secret never matched the doc.
 
 Credentials are stored in the Gitea org-scope secret vault under `novoyuuparosk-wiki` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo.
 
@@ -86,7 +88,9 @@ Secrets and variables are scoped to the `novoyuuparosk-wiki` org, inherited by a
 | Runner execution | Docker, added as a service to the existing Gitea docker-compose | 2026-06-09 |
 | Runner network mode | `host` — job containers need to reach Gitea on localhost | 2026-06-09 |
 | Secret/runner scope | User-level on `mikkeli` (no orgs on this instance) | 2026-06-09 |
-| Ownership | This repo and all three source repos moved to the `novoyuuparosk-wiki` org. Keeping caller and callee under one owner avoids the cross-owner read gate on private reusable workflows (Settings → Actions → General → collaborative owners, Gitea 1.26+). Secrets/variables re-created at org scope; runner must serve org-owned runs | 2026-08-11 |
+| Ownership | This repo and all three source repos moved to the `novoyuuparosk-wiki` org. Secrets/variables re-created at org scope; runner re-registered instance-level so it serves org-owned runs | 2026-08-11 |
+| **This repo must stay public** | `act_runner` resolves a cross-repo `uses:` by cloning the callee **anonymously** — the job token is not applied. A private callee therefore 404s with `repository not found`, regardless of the caller sharing its owner. Shared ownership does **not** satisfy the read requirement. Alternative if it must be private again: Settings → Actions → General → collaborative owners (Gitea 1.26+), untested here | 2026-08-11 |
+| Runner cache masks this | The resolved callee is cached at `/root/.cache/act/<owner>-<repo>@<ref>`. Changing owner changes the key, so a working pipeline can break on a clone that had been served from cache for months. Suspect the cache before suspecting permissions | 2026-08-11 |
 | Container registry | Packages are not transferable in Gitea, so images stay at `pi5-16.local:3005/mikkeli/*` for now. Registry auth still uses the `mikkeli`-owned `PKGRW_PAT` | 2026-08-11 |
 | MediaWiki API path | `api.php` (classic action API) | 2026-06-09 |
 | Branch naming (this repo) | `automation/<pipeline>` for pipeline-development branches | 2026-06-09 |