fix: Forgejo CI runners — proper images, shared docker socket, auto-registration

All CI workflows across all repos were broken. Three root causes:

1. Runner labels pointed to bare Alpine image (forgejo/runner:6) which has
   no Node.js, no docker, no Go/Rust, no root, no apt-get. Every workflow
   step failed immediately.

   Fix: Change labels to official Debian language images:
     golang → docker://golang:1.26-bookworm
     node   → docker://node:22-bookworm
     rust   → docker://rust:1-bookworm

2. Docker socket not shared between dind sidecar and runner container.
   dind creates /run/docker.sock in its own filesystem. Runner container
   has a separate filesystem and can't see it. Workflow containers that
   run 'docker build' get 'Cannot connect to Docker daemon'.

   Fix: Share /run between dind and runner via emptyDir volume.
   Add docker_host: automount to runner config so the socket is
   mounted into workflow containers automatically.

   Note: /var/run is a symlink to /run in Alpine — must mount at /run.

3. Init container skipped re-registration if .runner file existed on PVC.
   Changing labels in values.yaml had no effect until PVC was manually
   deleted — not GitOps-friendly.

   Fix: Always rm .runner and re-register on pod start. Labels stay
   in sync with values.yaml automatically.

Also removes custom Dockerfiles and build-runner-images workflow — no longer
needed since official images provide the language tools directly.

k8s/infra/forgejo-runner/values.yaml

@@ -1,9 +1,12 @@
 runner:
   image:
     repository: code.forgejo.org/forgejo/runner
-    tag: "6"  # Bootstrap with runner image, CI builds custom with Node.js
+    tag: "6"
   name: golang-runner
-  labels: "golang:docker://code.forgejo.org/forgejo/runner:6"
+  # Label image is what workflow steps run in (NOT the runner daemon image).
+  # golang:1.26-bookworm: Debian, root, apt-get, Go, git.
+  # Install Node.js/docker in workflow steps as needed.
+  labels: "golang:docker://golang:1.26-bookworm"
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000
   tokenSecret: runner-token
   resources: