feat: add ArgoCD Image Updater tracking for runner images

- Added Image Updater annotations to forgejo-runner Applications
- Image Updater now automatically tracks new images in Forgejo registry
- Update strategy: newest-build (latest commit SHA)
- Tag filter: commits (7-char SHA), latest, and v* releases
- Helm values track repository + tag separately for automatic updates
- Write-back via git (commits image updates to main branch)

Build and push custom runner images:
  docker build -f k8s/infra/forgejo-runner/Dockerfile.golang \
    -t forgejo.riotpiao.com/rock/forgejo-runner-golang:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.rust \
    -t forgejo.riotpiao.com/rock/forgejo-runner-rust:latest .
  docker build -f k8s/infra/forgejo-runner/Dockerfile.node \
    -t forgejo.riotpiao.com/rock/forgejo-runner-node:latest .

  docker login forgejo.riotpiao.com
  docker push forgejo.riotpiao.com/rock/forgejo-runner-golang:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-rust:latest
  docker push forgejo.riotpiao.com/rock/forgejo-runner-node:latest

Image Updater will then:
1. Detect new images in registry
2. Update values.yaml automatically
3. Commit changes to git
4. ArgoCD syncs the new image tags

k8s/infra/forgejo-runner/values-node.yaml

@@ -5,6 +5,9 @@
 # node:22-bookworm ships Node natively. Docker client installed via workflow step if needed.
 # (homelab has no CI; custom runner images built manually if desired)
 runner:
+  image:
+    repository: forgejo.riotpiao.com/rock/forgejo-runner-node
+    tag: "latest"  # Image Updater tracks and updates this
   name: node-runner
   # Custom image: node:22-bookworm + docker.io pre-installed
   labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"