feat(gitea): reproducible Actions runner registration + harden runner config
- add scripts/gitea/register-runner.sh (idempotent register, host/docker modes,
capacity arg, admin-API registration token, --force re-register)
- GITEA_VM_SETUP.md Step 11: runner install/register, host-vs-docker tradeoffs,
token externalization (env_file), concurrency (capacity), token rotation,
end-to-end CI verification
- document runner registration + secrets in persist/ephemeral table
Live runner hardened separately: capacity 1->2, GITEA_NPM_TOKEN moved from
inline config.yaml to chmod-600 runner.env via env_file.
3224199894