Wire runner caches and forge secrets through agenix

services/forgejo-nsc/README.md

@@ -45,6 +45,9 @@ profile. The important knobs are:
 - `namespace.machine_type` / `namespace.duration` – shape + TTL for the ephemeral
   Namespace environment. The dispatcher destroys the instance after a job so the
   TTL acts as a hard cap, not an idle timeout.
+- `namespace.linux_cache_*` / `namespace.macos_cache_*` – persistent cache
+  volumes mounted into runners so Linux can keep `/nix` plus build caches warm
+  and macOS can reuse Rust toolchains, Xcode package caches, and derived data.
 
 ### Running locally
 
@@ -160,12 +163,15 @@ consume the same secret material.
 
 Long-lived runtime state is now sourced from age-encrypted files:
 
+- `secrets/forgejo/admin-password.age`
+- `secrets/forgejo/agent-ssh-key.age`
 - `secrets/forgejo/nsc-token.age`
 - `secrets/forgejo/nsc-dispatcher-config.age`
 - `secrets/forgejo/nsc-autoscaler-config.age`
 
 After refreshing the intake files, re-encrypt them into `secrets/forgejo/*.age`
 and deploy the forge host so `config.age.secrets.*` updates the live paths for
+`services.burrow.forge`, `services.burrow.forgeRunner`, and
 `services.burrow.forgejoNsc`.
 
 Run it next to the dispatcher: