feat: custom forgejo-runner-node image with docker.io pre-installed

- Dockerfile.node extends node:22-bookworm + docker.io
- CI workflow builds and pushes to forgejo registry on changes
- values-node.yaml references custom image instead of stock node
- Removes need to install docker in every workflow using node runner

k8s/infra/forgejo-runner/Dockerfile.node

@@ -0,0 +1,13 @@
+FROM node:22-bookworm
+
+# Install Docker client (dind sidecar provides the daemon)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+      docker.io \
+      git \
+      curl \
+      ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+
+# Verify installation
+RUN docker --version && node --version

k8s/infra/forgejo-runner/values-node.yaml

@@ -2,11 +2,12 @@
 # runner instance. Only runner.name and runner.labels differ -- everything
 # else (image, dind, persistence, tolerations, nodeSelector) is shared.
 #
-# node:22-bookworm ships Node natively, so unlike the golang/rust instances,
-# jobs on this runner need no "install node" step before actions/checkout.
+# forgejo-runner-node extends node:22-bookworm with docker.io, so Node + Docker
+# are both available. Built and pushed via homelab CI (build-runner-node.yml).
 runner:
   name: node-runner
-  labels: "node:docker://node:22-bookworm"
+  # Custom image extends node:22-bookworm with docker.io pre-installed
+  labels: "node:docker://forgejo.riotpiao.com/rock/forgejo-runner-node:latest"
 
 # GC CronJob renders only from the default (golang) values to avoid duplicates
 gc: