feat: add Node.js to all runner images (golang, rust, node)

- Dockerfile.golang: docker:27-cli + Node.js + build tools
- Dockerfile.rust: docker:27-cli + Node.js + Rust + build tools
- Dockerfile.node: node:22-bookworm + docker.io (already has Node.js)
- All runners now support GitHub Actions (checkout@v4 requires Node.js)
- Images built/pushed manually (no CI for homelab)

To build and push:
  docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
    -t forgejo.riotpiao.com/rock/forgejo-runner-golang:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
    -t forgejo.riotpiao.com/rock/forgejo-runner-rust:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
    -t forgejo.riotpiao.com/rock/forgejo-runner-node:latest .

  docker push forgejo.riotpiao.com/rock/forgejo-runner-golang:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-rust:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-node:latest

k8s/infra/forgejo-runner/values.yaml

@@ -3,15 +3,12 @@ runner:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"          # pin exact release before apply
   name: golang-runner
-  # Use docker:27-cli instead of golang:1.26-bookworm because:
-  #   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Has docker CLI + git + golang + all build tools
-  #   - golang:1.26-bookworm lacks Node.js (causes action failures)
-  # docker:27-cli includes Go toolchain via base debian + additional packages
-  # Verified tag: docker manifest inspect docker:27-cli ✓
-  labels: "golang:docker://docker:27-cli"
-  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
-  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
+  # Custom image: docker:27-cli + Node.js + Go + build tools
+  #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
+  #   - Docker CLI for container builds
+  #   - Go toolchain
+  #   - Build essentials
+  labels: "golang:docker://forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   # tokenSecret: name of the K8s Secret that holds the runner registration token
   # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)