feat(forgejo-runner): split into golang/node/rust runners, retire generic docker runner

k8s/infra/forgejo-runner/values.yaml

@@ -2,8 +2,14 @@ runner:
   image:
     repository: code.forgejo.org/forgejo/runner
     tag: "6"          # pin exact release before apply
-  name: talos-runner
-  labels: "docker:docker://node:22-bookworm"
+  name: golang-runner
+  # Default image is only used when a job's `container:` doesn't override it
+  # (both ci.yaml and build.yaml in homelab-frontend do). Retired the old
+  # "docker" label entirely; every repo this runner serves is Go, so this
+  # instance carries the golang toolchain and its own dind sidecar builds and
+  # pushes that repo's images too -- there is no separate generic runner
+  # anymore.
+  labels: "golang:docker://golang:1.25-bookworm"
   # In-cluster Service (:3000) — direct, avoids the ingress/public-hostname hop
   # (the public URL is :443 which forgejo doesn't serve; runner got i/o timeout).
   forgejoUrl: http://forgejo-gitea-http.cicd.svc.cluster.local:3000