gitea-runner: stack + playbook for self-hosted Actions

Central runner on ana-docker (gitea is local; existing fleet tooling
already SSHes from there). Playbook is parameterized so future
site-local runners (nh3-docker, esh-docker-vm) drop in via --var
overrides instead of copy-paste.

Includes a workflow template for vh/task-board that calls the existing
deploy-task-board.yaml playbook — keeps the playbook as the single
source of truth for "how task-board is deployed", manual or automated.

Labels embed `:docker://node:20-bookworm-slim` schema; without it,
act_runner v0.6+ silently falls back to host-mode and runs job steps
inside the Alpine runner container (no apt/python/node), breaking any
real workflow. node:20-bookworm-slim is small + has git + node so
actions/checkout works out of the box.

stacks/task-board/README.md

@@ -11,8 +11,24 @@ the deploy playbook. Not pulled from a registry.
 
 ## Deploy
 
-Via elway — see `playbooks/deploy-task-board.yaml` in the eshpfi-management
-root. The playbook owns the full flow: clone/update the source repo,
+Two paths — automated (preferred) and manual (escape hatch / first-time).
+
+### Automated (Gitea Actions, push-to-main)
+
+Once the central gitea-runner is up (see `stacks/gitea-runner/README.md`),
+every push to `main` on `vh/task-board` triggers a deploy. The workflow
+just calls the same elway playbook below; the playbook stays the
+single source of truth for "how task-board is deployed."
+
+Workflow template lives next to this README at
+[`gitea-workflow-deploy.yaml.example`](gitea-workflow-deploy.yaml.example);
+copy it into the task-board repo at `.gitea/workflows/deploy.yaml`.
+The example header lists the two repo secrets required
+(`DEPLOY_SSH_KEY`, `MGMT_REPO_TOKEN`).
+
+### Manual (elway from a workstation)
+
+The playbook owns the full flow: clone/update the source repo,
 `docker build`, install compose + seed .env, bring up, verify health.
 
 ```bash