bootstrap: use base images for runners, custom images via CI

- golang-runner: docker:27-cli (has Node.js + docker)
- rust-runner: docker:27-cli (bootstrap, CI adds Rust)
- node-runner: node:22-bookworm (has Node.js, CI adds docker)

CI workflow (.gitea/workflows/build-runner-images.yml):
1. Watches Dockerfile.* changes
2. Builds custom images with Node.js pre-installed
3. Pushes to registry
4. Image Updater detects and updates values.yaml
5. ArgoCD syncs to new custom images

This avoids token complexity - just push Dockerfile changes to git!

k8s/infra/forgejo-runner/values.yaml

@@ -1,17 +1,10 @@
 runner:
   image:
-    repository: forgejo.riotpiao.com/rock/forgejo-runner-golang
-    tag: "latest"  # Image Updater tracks and updates this
+    repository: docker
+    tag: "27-cli"  # Bootstrap with base image, custom image via CI+Image Updater
   name: golang-runner
-  # Custom image: docker:27-cli + Node.js + Go + build tools
-  #   - Node.js for GitHub Actions (actions/checkout@v4, etc.)
-  #   - Docker CLI for container builds
-  #   - Go toolchain
-  #   - Build essentials
-  labels: "golang:docker://forgejo.riotpiao.com/rock/forgejo-runner-golang:latest"
+  labels: "golang:docker://docker:27-cli"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
-  # tokenSecret: name of the K8s Secret that holds the runner registration token
-  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
   tokenSecret: runner-token
   resources:
     requests: