feat(gitea-runner): opt-in fast runner on nh3-docker (label nh3-docker), no docker socket in jobs

Prime's CI fix A. ana-docker's runner sits on HDD mirrors with no SLOG; synced
8 KiB writes measured ~34 ms there vs ~2.7 ms on nh3-docker (same probe, one run,
n=3 each). Repos opt in with runs-on: nh3-docker; the runner carries no
pfi-fleet label. Its config is tighter because nh3-docker also runs NH3 DNS and
the post office: docker_host '-' (verified absent in the job, present on the
ana-docker baseline), capacity 1, jobs capped at 4 GiB / 6 CPUs, a network per
job. The deploy playbook takes runner_config; each runner's homepage name is
its runner name.

stacks/gitea-runner/compose.yaml

@@ -28,7 +28,7 @@ services:
       - tnet
     labels:
       - homepage.group=Agents (no UI)
-      - homepage.name=gitea-runner
+      - homepage.name=${GITEA_RUNNER_NAME}
       - homepage.icon=mdi-cog-play
       - homepage.description=Gitea Actions self-hosted runner (${GITEA_RUNNER_NAME})