fix: Forgejo CI runners — proper images, shared docker socket, auto-registration

All CI workflows across all repos were broken. Three root causes:

1. Runner labels pointed to bare Alpine image (forgejo/runner:6) which has
   no Node.js, no docker, no Go/Rust, no root, no apt-get. Every workflow
   step failed immediately.

   Fix: Change labels to official Debian language images:
     golang → docker://golang:1.26-bookworm
     node   → docker://node:22-bookworm
     rust   → docker://rust:1-bookworm

2. Docker socket not shared between dind sidecar and runner container.
   dind creates /run/docker.sock in its own filesystem. Runner container
   has a separate filesystem and can't see it. Workflow containers that
   run 'docker build' get 'Cannot connect to Docker daemon'.

   Fix: Share /run between dind and runner via emptyDir volume.
   Add docker_host: automount to runner config so the socket is
   mounted into workflow containers automatically.

   Note: /var/run is a symlink to /run in Alpine — must mount at /run.

3. Init container skipped re-registration if .runner file existed on PVC.
   Changing labels in values.yaml had no effect until PVC was manually
   deleted — not GitOps-friendly.

   Fix: Always rm .runner and re-register on pod start. Labels stay
   in sync with values.yaml automatically.

Also removes custom Dockerfiles and build-runner-images workflow — no longer
needed since official images provide the language tools directly.

k8s/infra/forgejo-runner/templates/configmap.yaml

@@ -36,3 +36,4 @@ data:
       valid_volumes:
         - /docker-certs/client
       network: host
+      docker_host: automount

k8s/infra/forgejo-runner/templates/deployment.yaml

@@ -34,7 +34,11 @@ spec:
           command: ["sh", "-c"]
           args:
             - |
-              test -f /data/.runner || forgejo-runner register --no-interactive \
+              # Always re-register to keep labels in sync with values.yaml.
+              # Without this, changing a runner label requires manually deleting
+              # the PVC or .runner file — not GitOps-friendly.
+              rm -f /data/.runner
+              forgejo-runner register --no-interactive \
                 --instance {{ .Values.runner.forgejoUrl }} \
                 --token $(RUNNER_TOKEN) \
                 --name {{ .Values.runner.name }} \
@@ -70,6 +74,8 @@ spec:
               mountPath: /data
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: homelab-ca
               mountPath: /etc/ssl/certs/homelab-ca.pem
               subPath: ca.crt
@@ -89,6 +95,8 @@ spec:
           volumeMounts:
             - name: docker-certs
               mountPath: /docker-certs
+            - name: docker-sock
+              mountPath: /run
             - name: dind-storage
               mountPath: /var/lib/docker
             - name: homelab-ca
@@ -113,6 +121,8 @@ spec:
             claimName: {{ .Release.Name }}-dind
         - name: docker-certs
           emptyDir: {}    # DinD regenerates mTLS certs on each start
+        - name: docker-sock
+          emptyDir: {}    # Shared docker socket between dind and runner
         - name: homelab-ca
           # homelab-ca is a ConfigMap (public CA trust bundle), not a Secret.
           # The volumeMounts use subPath: ca.crt to project the single cert file.