Image is live at git.thermograph.org/emi/thermograph/ci-runner:v1.
register-lan-runner.sh's LABELS default now points at it, and the
live runner's registration was cut over directly (labels edited in
~/forgejo-runner/.runner, no re-registration needed).
docker-stack.yml previously had no cpu/memory limits on db or forgejo,
unlike every service in the app stack. Add generous limits (several
times observed steady-state usage) as a backstop, overridable via env
vars matching the app stack's convention.
Also add ci-runner/Dockerfile: a slim Debian base with the Docker CLI
+ buildx preinstalled, replacing node:20-bookworm (leftover from when
the frontend was Python/Jinja; nothing in CI uses npm/node anymore).
Closes a COPY --chown group-resolution bug in the classic Docker
builder that apt-get install docker.io currently pulls in on every
build-push job, and drops that install step's cost once cut over.
Built and verified locally; not yet pushed to the registry (needs a
write:package-scoped token) or wired into the live runner.
