docs: bring RUNBOOK and ARCHITECTURE up to date

The runner moved to node0 and the drift check reads release secrets via the
Kubernetes API in-cluster; the docs still described node2 and `helm list`.

- RUNBOOK: the durable image-cache fix is now the node0 hostPath store, not a
  node2 pin; /data is NFS RWX, so the Multi-Attach wait is gone. Cross-references
  entries 9 and 10.
- ARCHITECTURE: the reconciler's edge to the cluster is "list releases", not
  "helm list" (helm is the out-of-cluster fallback).
- ARCHITECTURE: the state diagram and its prose described fail() moving every
  dead-lettered instance to `failed`. Corrected to the per-kind behaviour — only
  provision fails the instance; deprovision stays `deleting` for retry, upgrade
  and verify stay `ready` — matching the fix in tasks.py.

RUNBOOK.md

@@ -118,11 +118,13 @@ kubectl -n gitea exec gitea-actions-runner-0 -c dind -- docker pull \
   ghcr.io/catthehacker/ubuntu:act-24.04@sha256:c710431fbad9eb3bcb102d04e5ff74fbd0ce6e383f78afebfb3770a1a817fdf9
 ```
 
-The durable fix is to stop the runner restarting. Its `/data` PVC is ReadWriteOnce, so
-every reschedule hits `Multi-Attach error` and the pod sits in Init until Longhorn detaches
-from the old node. It is pinned to node2 in `oci-k8s/.../addons/tasks/main.yml` for exactly
-that reason. A dedicated PVC for the image cache would survive restarts outright, but on
-this cluster that volume faulted and blocked the runner, so it is deliberately not used.
+The durable fix is a persistent image store, which the runner now has: `/var/lib/docker`
+is a hostPath on node0 (see `oci-k8s/.../addons/tasks/main.yml`), so the act image survives
+a restart and is not re-pulled. The runner is pinned to **node0**, not node2 — node2 is a
+single-core control-plane node whose pod network was measured 21x slower under its own
+load, which starved every clone and pull. Its `/data` PVC is NFS ReadWriteMany, so a
+reschedule attaches immediately with no `Multi-Attach` wait. Entries 9 and 10 cover the
+caches and the node move in full.
 
 ### 6. Stopping a run, and reading a restarted runner correctly