infra/forgejo: give the LAN runner's PATH ~/.local/bin

sops (and other user-installed CLI tools) live in ~/.local/bin, which
isn't on systemd --user's default PATH. Once a host is flipped into
SOPS-configured mode (the /etc/thermograph/secrets-env marker),
render-secrets.sh's own render step fails outright ("sops not
installed but this host is configured for SOPS secrets") even though
it's installed for the interactive user -- the runner just can't see
it. Found via the LAN dev daemon crash-looping on a missing
THERMOGRAPH_AUTH_SECRET after dev.yaml correctly gained one.

infra/deploy/forgejo/register-lan-runner.sh

@@ -82,6 +82,11 @@ After=network-online.target
 
 [Service]
 WorkingDirectory=${RUNNER_DIR}
+# CI job steps shell out to user-installed tools (sops, age, ...) that live in
+# ~/.local/bin, not on systemd --user's default PATH. Without this, any
+# workflow that needs one (e.g. render-secrets.sh once a host is
+# SOPS-configured) fails with "not installed" even though it plainly is.
+Environment=PATH=%h/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
 ExecStart=${RUNNER_DIR}/forgejo-runner daemon -c config.yaml
 Restart=on-failure
 RestartSec=5