Document self-hosted Kubernetes DinD prerequisites for gh-aw (#40107)

[Tarekchehahde]

Problem

Self-hosted runner operators on Kubernetes (ARC DinD or custom pods) hit confusion about:

• Whether the runner container needs privileged: true or NET_ADMIN
• Whether host iptables is required (vs Docker network isolation inside DinD)
• Whether to share /tmp vs $RUNNER_TEMP / shared _work volume
• Where cli-proxy / firewall logs live when runner.topology: arc-dind (searching /tmp/gh-aw/... finds nothing)

Reported in #40107.

Proposed documentation changes

docs/src/content/docs/reference/self-hosted-runners.md

Before: ARC DinD guidance split across two sections; no explicit K8s prerequisite matrix; no path map for arc-dind vs GitHub-hosted /tmp/gh-aw/...; no cli-proxy troubleshooting.

After: Add:

• Kubernetes pod prerequisites table (privileged sidecar only, shared _work, no separate /tmp, optional docker socket overrides)
• Path map (/tmp/gh-aw/... vs ${{ runner.temp }}/gh-aw/...)
• Debugging AWF sidecars (job log → on-disk logs → docker logs; DIFC / wrong log path)
• Consolidate duplicate ARC section into a short pointer

docs/src/content/docs/guides/arc-dind-copilot-agent.md

After: Note custom K8s pods can use same prerequisites; extend troubleshooting for awf-cli-proxy is unhealthy, cli-proxy log paths, host iptables confusion.

docs/src/content/docs/troubleshooting/debugging.md + compilation-process.md

After: Qualify artifact paths for runner.topology: arc-dind.

Fork PR

• docs: self-hosted Kubernetes DinD prerequisites (#40107) Tarekchehahde/gh-aw#16 (branch fix/40107-self-hosted-k8s-docs)
• Upstream compare: main...Tarekchehahde:gh-aw:fix/40107-self-hosted-k8s-docs

Fixes #40107

[Tarekchehahde]

Fork PR: Tarekchehahde#16

[pelikhan]

@lpcox

[pelikhan]

@Tarekchehahde Thank you. Please distilled findings as an issue, not a forked PR.