runner: drop volume name prefix, whitelist in valid_volumes

runner/config.yaml

@@ -25,7 +25,12 @@ container:
   options: "-v cargoxx-cache-store:/srv/cargoxx-cache/store
             -v cargoxx-cache-keys:/srv/cargoxx-cache/keys:ro"
   workdir_parent: /workspace
-  valid_volumes: []
+  # Whitelist regex of bind sources act_runner is allowed to forward to
+  # spawned job containers. Must include the cache + key volumes named
+  # in `options` above (otherwise act_runner silently strips them).
+  valid_volumes:
+    - "^cargoxx-cache-store$"
+    - "^cargoxx-cache-keys$"
   docker_host: "unix:///var/run/docker.sock"
   force_pull: false