ci: fix runner labels + CoreDNS rewrite + cleanup

- Runners use public images (code.forgejo.org/forgejo/runner:6)
- Labels pull from Docker Hub: golang:1.26, node:22, rust:1-bookworm
- Add CoreDNS api.riotpiao.com rewrite
- Fix runner re-registration to keep labels in sync
- Add unified CI pattern docs to CLAUDE.example.md
- Remove dead .forgejo/ workflow dir (Forgejo uses .gitea/)

k8s/infra/forgejo-runner/values.yaml

@@ -1,20 +1,13 @@
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
-    tag: "6"          # pin exact release before apply
+    tag: "6"
   name: golang-runner
-  # Use docker:27-cli instead of golang:1.26-bookworm because:
-  #   - Needs Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Has docker CLI + git + golang + all build tools
-  #   - golang:1.26-bookworm lacks Node.js (causes action failures)
-  # docker:27-cli includes Go toolchain via base debian + additional packages
-  # Verified tag: docker manifest inspect docker:27-cli ✓
-  labels: "golang:docker://docker:27-cli"
-  # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
-  # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
+  # Label image is what workflow steps run in (NOT the runner daemon image).
+  # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
+  # TODO: Switch to custom image once build-runner-images.yml pushes images
+  labels: "golang:docker://golang:1.26-bookworm"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
-  # tokenSecret: name of the K8s Secret that holds the runner registration token
-  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
   tokenSecret: runner-token
   resources:
     requests: