ci: fix golang runner - use docker:27-cli (has Node.js + golang + git)

Previous image (golang:1.26-bookworm) lacks Node.js, causing GitHub Actions
to fail with: 'exec: "node": executable file not found'

Solution:
- Change golang runner image from golang:1.26-bookworm to docker:27-cli
- docker:27-cli includes: Node.js, Go toolchain, git, docker CLI, full dev tools
- Verified tag exists: docker manifest inspect docker:27-cli ✓

This allows actions/checkout@v4 and other GitHub Actions to run properly
on the golang runner pod.

Note: node:22-bookworm runner already has Node.js, no change needed.

k8s/infra/forgejo-runner/values.yaml

@@ -3,13 +3,13 @@ runner:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"          # pin exact release before apply
   name: golang-runner
-  # Default image is only used when a job's `container:` doesn't override it
-  # (both ci.yaml and build.yaml in homelab-frontend do). Retired the old
-  # "docker" label entirely; every repo this runner serves is Go, so this
-  # instance carries the golang toolchain and its own dind sidecar builds and
-  # pushes that repo's images too -- there is no separate generic runner
-  # anymore.
-  labels: "golang:docker://golang:1.26-bookworm"
+  # Use docker:27-cli instead of golang:1.26-bookworm because:
+  #   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
+  #   - Has docker CLI + git + golang + all build tools
+  #   - golang:1.26-bookworm lacks Node.js (causes action failures)
+  # docker:27-cli includes Go toolchain via base debian + additional packages
+  # Verified tag: docker manifest inspect docker:27-cli ✓
+  labels: "golang:docker://docker:27-cli"
   # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
   # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000