Add in-cluster Forgejo Actions runner manifests (ADR-004)

DinD sidecar + forgejo-runner Deployment with PVC-backed registration
state. Makefile targets for registration secret, deploy, and status.

helm/forgejo-runner-registration.sops.yaml.template

@@ -0,0 +1,15 @@
+# Encrypt as helm/forgejo-runner-registration.sops.yaml, then:
+#   kubectl apply -f <(sops -d helm/forgejo-runner-registration.sops.yaml)
+#
+# Generate token (one-time, do not commit plaintext):
+#   kubectl exec -n forgejo deploy/forgejo-gitea -- \
+#     forgejo actions generate-runner-token --scope coulomb
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: forgejo-runner-registration
+  namespace: forgejo
+type: Opaque
+stringData:
+  token: REPLACE_WITH_RUNNER_REGISTRATION_TOKEN