gitea-runner: stack + playbook for self-hosted Actions

Central runner on ana-docker (gitea is local; existing fleet tooling
already SSHes from there). Playbook is parameterized so future
site-local runners (nh3-docker, esh-docker-vm) drop in via --var
overrides instead of copy-paste.

Includes a workflow template for vh/task-board that calls the existing
deploy-task-board.yaml playbook — keeps the playbook as the single
source of truth for "how task-board is deployed", manual or automated.

Labels embed `:docker://node:20-bookworm-slim` schema; without it,
act_runner v0.6+ silently falls back to host-mode and runs job steps
inside the Alpine runner container (no apt/python/node), breaking any
real workflow. node:20-bookworm-slim is small + has git + node so
actions/checkout works out of the box.

stacks/gitea-runner/conf/config.yaml

@@ -0,0 +1,55 @@
+# act_runner config. Mounted into the runner container at
+# /data/config.yaml (CONFIG_FILE env var points here).
+#
+# Reference: https://docs.gitea.com/usage/actions/act-runner
+
+log:
+  level: info
+
+runner:
+  # Persisted registration credentials. Created on first successful
+  # `register`; reused on subsequent starts.
+  file: /data/.runner
+
+  # Max parallel jobs this runner will accept.
+  capacity: 2
+
+  # Hard timeout per job — covers a wedged docker build, a hung ssh,
+  # etc. 30m is generous for our deploy workflows (mostly seconds).
+  timeout: 30m
+
+  # Time given to a job to clean up after a SIGTERM before SIGKILL.
+  shutdown_timeout: 1m
+
+  # TLS verification when talking to gitea. KEEP true in prod.
+  insecure: false
+
+  # Polling cadence + per-poll HTTP timeout.
+  fetch_timeout: 5s
+  fetch_interval: 2s
+
+cache:
+  # Provides actions-cache-compatible storage for `actions/cache`.
+  enabled: true
+  dir: /data/cache
+
+container:
+  # Job containers join this docker network. Lets workflow steps
+  # talk to other compose services (gitea itself, registries, etc.)
+  # by container name.
+  network: traefik-net
+
+  privileged: false
+
+  # Job containers' working dir is mounted under here on the host
+  # (via the runner's docker.sock spawning). Kept on the runner's
+  # /data volume so workspaces persist briefly between steps.
+  workdir_parent: /data/workspace
+
+  # Volumes the runner allows job containers to bind-mount. Keep tight.
+  valid_volumes: []
+
+  force_pull: false
+
+host:
+  workdir_parent: /data/host-workspace