hadolint/hadolint-action declares `runs: using: docker`, so the runner
builds and runs it as a container. Routing it to arc-runner-small (no dind)
failed the job at "Build hadolint/hadolint-action", before checkout.
The audit that produced the earlier routing grepped job bodies for docker
commands, which can't see this: nothing in the YAML says "docker" — the
dependency is in the action's own metadata. The right check is each step's
`runs.using`.
Swept every job on the dind-less sets (arc-runner-set, arc-runner-small)
against the `runs.using` of every action it invokes: hadolint was the only
`using: docker` action. shellcheck is composite, everything else is node24.