A single PR push fires pr-build, secrets-guard, and shell-lint as three
independent workflows with no dependency between them, so the previous
capacity (3, an earlier undocumented hand-tune of the tool's default of
1) already serializes build-backend/build-frontend/validate-observability
behind them even with 16 idle cores on the runner host. Raise to 8 and
track it in register-lan-runner.sh so a re-provision doesn't silently
drop back to the default.
Also document why more capacity belongs on the desktop rather than a
runner on prod/beta: docker_host: automount gives job containers the
host's own Docker socket, which on a live app or Forgejo host means any
CI job gets root-equivalent access to what else is running there. An
earlier stack revision did run the runner on beta and was reverted for
this reason.
