Add Forgejo T05 verify, operator bootstrap, and security hardening

Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.

tools/forgejo-runner-registration-sops-bootstrap.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# One-time: capture cluster runner registration token into SOPS (operator host with age key).
+# RAIL-HO-WP-0005 T05 — closes runner secret gap when bootstrap used kubectl create secret.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+OUT="${ROOT}/helm/forgejo-runner-registration.sops.yaml"
+KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config-hosteurope}"
+FORGEJO_NAMESPACE="${FORGEJO_NAMESPACE:-forgejo}"
+
+export KUBECONFIG
+
+if ! command -v sops >/dev/null 2>&1; then
+  echo "ERROR: sops required" >&2
+  exit 1
+fi
+
+if [[ -f "${OUT}" ]]; then
+  echo "Already exists: ${OUT}" >&2
+  echo "Remove it first if you intend to re-capture from cluster." >&2
+  exit 1
+fi
+
+token="$(kubectl get secret forgejo-runner-registration -n "${FORGEJO_NAMESPACE}" \
+  -o jsonpath='{.data.token}' | base64 -d)"
+if [[ -z "${token}" ]]; then
+  echo "ERROR: forgejo-runner-registration secret missing or empty in ${FORGEJO_NAMESPACE}" >&2
+  exit 1
+fi
+
+cat > "${OUT}" <<EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: forgejo-runner-registration
+  namespace: ${FORGEJO_NAMESPACE}
+type: Opaque
+stringData:
+  token: ${token}
+EOF
+
+sops --encrypt --in-place "${OUT}"
+echo "Created ${OUT}"
+echo "Verify: SOPS_SENTINEL=${OUT} make check-sops"