Enabling workflow-wide Docker-in-Docker configuration breaks gh aw workflows

[dkurepa]

Problem

Workflows compiled with gh aw fail when Docker-in-Docker is enabled at workflow scope. In practice, this
means agentic workflows that need to build or run Docker images are not working reliably out of the box.

Repro configuration

Adding the following to the workflow is enough to trigger the problem:

services:
  dind:
    image: docker:dind
    options: --privileged
    ports:
      - 2375:2375
    env:
      DOCKER_TLS_CERTDIR: ""

env:
  DOCKER_HOST: tcp://localhost:2375

network:
  allowed:
    - defaults
    - containers

Impact

After compiling, the workflow fails during startup with:

 [INFO] Set DOCKER_API_VERSION=1.54 (server current)
 Error:  Port 80 is not exposed from the container
 Error:  Add port mapping: -p <host_port>:80

Expected behavior

A workflow should be able to enable Docker-in-Docker support without breaking the generated workflow.

[pelikhan]

@lpcox we need to document why it is disabled