gitea-runner: stack + playbook for self-hosted Actions

Central runner on ana-docker (gitea is local; existing fleet tooling
already SSHes from there). Playbook is parameterized so future
site-local runners (nh3-docker, esh-docker-vm) drop in via --var
overrides instead of copy-paste.

Includes a workflow template for vh/task-board that calls the existing
deploy-task-board.yaml playbook — keeps the playbook as the single
source of truth for "how task-board is deployed", manual or automated.

Labels embed `:docker://node:20-bookworm-slim` schema; without it,
act_runner v0.6+ silently falls back to host-mode and runs job steps
inside the Alpine runner container (no apt/python/node), breaking any
real workflow. node:20-bookworm-slim is small + has git + node so
actions/checkout works out of the box.

stacks/gitea-runner/compose.yaml

@@ -0,0 +1,38 @@
+# Gitea Actions self-hosted runner.
+#
+# Polls https://gitea.phasefinal.com for queued jobs and runs them in
+# ephemeral job-containers spawned via the host docker socket. The
+# runner registers itself on first start using
+# GITEA_RUNNER_REGISTRATION_TOKEN; subsequent starts reuse credentials
+# cached at ${DATA_DIR}/.runner.
+#
+# Tunables live in .env. config.yaml controls runner internals (job
+# timeouts, capacity, container engine settings) — edit conf/config.yaml,
+# don't inline that here.
+
+services:
+  runner:
+    image: ${RUNNER_IMAGE}
+    container_name: gitea-runner
+    restart: unless-stopped
+    environment:
+      - GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
+      - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME}
+      - GITEA_RUNNER_LABELS=${GITEA_RUNNER_LABELS}
+      - CONFIG_FILE=/data/config.yaml
+    volumes:
+      - ${DATA_DIR}:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    networks:
+      - tnet
+    labels:
+      - homepage.group=Toolchain
+      - homepage.name=gitea-runner
+      - homepage.icon=mdi-cog-play
+      - homepage.description=Gitea Actions self-hosted runner (${GITEA_RUNNER_NAME})
+
+networks:
+  tnet:
+    name: traefik-net
+    external: true