Add Self-Hosted Runner Doctor workflow for ARC/DinD and enterprise AWF triage

.github/workflows/self-hosted-runner-doctor-updater.md

@@ -0,0 +1,116 @@
+---
+name: Runner Doctor Updater
+description: Daily workflow that reviews new self-hosted, ARC/DinD, GHEC, and GHES issues and PRs since the previous run and proposes updates to keep the Self-Hosted Runner Doctor knowledge base current.
+on:
+  schedule: daily
+  workflow_dispatch:
+  skip-if-match:
+    query: 'is:issue is:open label:runner-doctor'
+    max: 1
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+imports:
+  - shared/self-hosted-failure-modes.md
+tools:
+  github:
+    toolsets: [default]
+  bash: true
+  cache-memory: true
+sandbox:
+  agent:
+    id: awf
+network:
+  allowed:
+    - github
+safe-outputs:
+  threat-detection:
+    enabled: false
+  create-issue:
+    title-prefix: "🩺 Runner Doctor Update"
+    labels: [runner-doctor, automated]
+    max: 1
+    expires: 30d
+timeout-minutes: 20
+steps:
+  - name: Compute scan window
+    id: window
+    run: |
+      # Look back two days so a missed daily run does not create a coverage gap.
+      # Overlap is de-duplicated by checking existing knowledge-base citations.
+      SINCE=$(date -u -d '2 days ago' +%Y-%m-%d)
+      echo "since=$SINCE" >> "$GITHUB_OUTPUT"
+      echo "Scanning for self-hosted runner lessons updated since $SINCE"
+---
+
+# Runner Doctor Updater
+
+You are the maintenance agent for the **Self-Hosted Runner Doctor**. Each day you review newly updated issues and pull requests that relate to AWF on non-GitHub-hosted environments — self-hosted runners, ARC + DinD, GHEC (`*.ghe.com`), GHES, and enterprise runners — and you propose concrete updates so the doctor's knowledge base stays current.
+
+You do **not** edit files yourself. Your only output is a single proposed-changes issue (or a `noop`).
+
+## Scan window
+
+- **Repository:** ${{ github.repository }}
+- **Since (UTC date):** `${{ steps.window.outputs.since }}`
+
+Consider issues and pull requests **updated on or after** the scan window. The window deliberately overlaps the previous daily run, so de-duplicate against lessons that are already captured.
+
+## Step 1 — Find relevant issues and PRs
+
+Search this repository for items updated since the scan window that involve non-hosted runner environments. Combine the date qualifier `updated:>=${{ steps.window.outputs.since }}` with these signals (search several; do not assume one query is enough):
+
+`ARC`, `DinD`, `self-hosted`, `GHES`, `GHEC`, `ghe.com`, `DOCKER_HOST`, `docker-host-path-prefix`, `chroot`, `musl`, `Alpine`, `IPv6`, `corporate proxy`, `cache_peer`, `GH_HOST`, `resolv.conf`, `toolcache`, `_tool`, `one-shot-token`, `capsh`, `passwd`.
+
+Include **both open and closed** items — closed issues and merged PRs usually carry the actual fix and the citation numbers worth recording. Read the body and key comments of each candidate to confirm it is a genuine non-hosted-runner lesson (ignore unrelated CI flakes, refactors, and GitHub-hosted-only reports).
+
+## Step 2 — Extract the lesson
+
+For each relevant item, capture: the observable symptom / error string, the affected platform(s), the root cause, the fix (AWF flag, config field, env var, or version bump), and a read-only diagnostic the doctor could run.
+
+## Step 3 — Compare against the current doctor
+
+The current failure-mode catalog is imported below. Also read the live files to propose precise edits:
+
+```bash
+cat .github/workflows/shared/self-hosted-failure-modes.md
+cat .github/workflows/self-hosted-runner-doctor.md
+```
+
+Classify each lesson as one of:
+
+- **Already covered** — its citation issue/PR numbers already appear in the catalog ⇒ skip.
+- **New failure mode** — assign the next free ID in the correct category (`A` = ARC/DinD, `B` = self-hosted, `C` = GHES/GHEC/data-residency, `D` = runtimes/network) and propose a new table row.
+- **Update to an existing mode** — add a new citation, flip a status (e.g. open → fixed), or improve the fix/probe wording.
+- **New error-string lookup entry** — a recognizable error string that should map to a mode in the doctor's quick-lookup.
+
+## Step 4 — Avoid duplicate proposals
+
+Before creating an issue, search existing open issues labelled `runner-doctor`. If an open proposal already covers the same lessons, call `noop` instead of stacking another issue.
+
+## Output
+
+If you found concrete, not-yet-captured updates, call `create-issue` **once** with this structure:
+
+### Summary
+- scan window and number of items reviewed
+- number of genuinely new lessons
+
+### Proposed knowledge-base changes
+For `.github/workflows/shared/self-hosted-failure-modes.md`: the exact table row(s) to add or modify, including the failure-mode ID, category, and citation numbers.
+
+### Proposed doctor changes
+For `.github/workflows/self-hosted-runner-doctor.md`: any playbook or error-string lookup additions.
+
+### Source issues and PRs
+Every proposed change must cite the issue/PR number(s) it derives from, with links.
+
+If there are **no** new lessons, call `noop` with a one-line explanation. Do not open an empty or speculative issue.
+
+## Guardrails
+
+- Propose knowledge/documentation edits only — never modify code, never open a pull request.
+- Keep existing failure-mode IDs stable; only append new IDs.
+- Prefer the narrowest change; do not restructure entries that already work.
+- Skip anything whose citation numbers are already present in the catalog.