fix: update usage guide to clarify network setup and add runner scoping instructions

USAGE_GUIDE.md

@@ -21,14 +21,17 @@ Step-by-step instructions for running the migration, handling failures, rolling
 
 ## Before You Start
 
-### 1. Network and DNS
+### 1. Network
 
 Before running anything, confirm:
 
 - MacBook can SSH to Unraid: `ssh user@UNRAID_IP`
 - MacBook can SSH to Fedora: `ssh user@FEDORA_IP`
-- A DNS A record exists for your Gitea domain pointing to `UNRAID_IP`
 - Macvlan container IPs are available on the LAN (not already in use)
+
+DNS and TLS are only needed for Phase 8 (Caddy reverse proxy). You can set these up later:
+
+- A DNS A record for your Gitea domain pointing to `UNRAID_IP`
 - If using `TLS_MODE=cloudflare`: a Cloudflare API token with Zone:DNS:Edit permission
 
 ### 2. Passwordless sudo on remote hosts
@@ -666,6 +669,30 @@ Then deploy:
 
 For Docker runners, this stops and removes the container. For native runners, this unloads the launchd service, removes the plist, and optionally deletes the runner data directory. If the native runner was deployed with `boot = true`, removal uses `sudo` for `launchctl unload` and plist deletion.
 
+### Scoping runners to specific repos
+
+By default, runners use `repos = all` (instance-level — available to every repo). To scope a runner to specific repos, use comma-separated names in `runners.conf`:
+
+```ini
+[ci-runner]
+host     = unraid
+type     = docker
+repos    = augur,periodvault
+# ... other fields
+```
+
+`configure_runners.sh` automatically expands this into separate sections (one per repo), since each `act_runner` process can only register to a single repo:
+
+```ini
+[ci-runner-augur]
+repos    = augur
+# ... same config
+
+[ci-runner-periodvault]
+repos    = periodvault
+# ... same config
+```
+
 ### Runner types
 
 | Type | Deployed On | How It Works |