diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 53b6f73..ac43de0 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -16,12 +16,19 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# runner 分配:
+#   · runs-on: ubuntu-latest —— 在 catthehacker 容器里跑,仅用于纯 bash 扫描
+#     (redline/cleartext/portable-sql);容器内**不能**嵌套 `docker run`(DinD 挂载
+#     失败,$PWD 在宿主不存在),故套 docker 的 job 不能用它。
+#   · runs-on: nas —— host 模式(mac-pangolin-2 直接在宿主跑),`docker run` 是宿主
+#     真 docker(非嵌套),可正常拉/跑 node/golang/flutter/python/shellcheck 镜像。
+#     golden 保留 ghcr.io/cirruslabs/flutter Linux 容器 → 与入库基线渲染一致。
 jobs:
 
   # ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
   lint:
     name: Lint — shellcheck
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -74,7 +81,7 @@ jobs:
   # ── Job 2: OpenAPI Sync Check ────────────────────────────────────────────
   openapi-check:
     name: OpenAPI Sync Check
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -113,7 +120,7 @@ jobs:
   # ── Job 4: Flutter 客户端(分析 + 单测/组件测试)────────────────────────
   flutter-client:
     name: Flutter — analyze + test
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -149,7 +156,7 @@ jobs:
   # (改了 design/colors_and_type.css 没重生成,或手改了生成物)。
   codegen-drift:
     name: Codegen Drift — token 生成物未漂移
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -163,7 +170,7 @@ jobs:
 
   ds-flow:
     name: DS-flow — 原型/跨端同源/代码色单源闸
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -182,7 +189,7 @@ jobs:
   # -tags integration(需 docker 起 mysql/redis),见 go-integration job。
   go-server:
     name: Go — build + test
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -208,7 +215,7 @@ jobs:
   # 详见 scripts/e2e-smoke.sh + server/test/e2e/。
   e2e-smoke:
     name: E2E Smoke — L4 进程级端到端
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -232,7 +239,7 @@ jobs:
   #   · -p 1 串行:一次只起一个 mysql 容器,避免并发把 Docker Desktop 压垮/端口资源争用。
   go-integration:
     name: Go — integration (mysql/redis testcontainers)
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -247,7 +254,7 @@ jobs:
   # tablet/desktop-stats golden 与 stats-overhaul 工作区耦合,待其合并后并入本 job。
   golden:
     name: Golden — 视觉回归 (全量:components/auth/desktop/tablet)
-    runs-on: ubuntu-latest
+    runs-on: nas
     steps:
       - name: Checkout
         uses: actions/checkout@v4