Add SOPS-encrypted Forgejo runner registration secret

Capture the in-cluster forgejo-runner-registration token into Git so
runner redeploys do not depend on a one-off kubectl create secret.

helm/forgejo-runner-registration.sops.yaml

@@ -0,0 +1,28 @@
+apiVersion: ENC[AES256_GCM,data:pgs=,iv:4Ubrj7wnLlRMXx8pLC/EbdcQYdFkh8i1Qo/eeXSqNaM=,tag:Y7naXVurchBl6MJu7eBiJg==,type:str]
+kind: ENC[AES256_GCM,data:hWqcL7x9,iv:O3hV4uekxGo2mfqCl9NGEYueaZDDenKZieLExofXZGM=,tag:3+Rkg4QCZS+sx2BUD36HiA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:oj1ZcRz2mdYhUKOy+VC3z3l45wyx6+oqn/KC,iv:8M7tlfyyY5bp6sHFhP9HXBUALYrnObxGvvqEVWCPR5A=,tag:EiOAxh54vMfOjX0lCpjykA==,type:str]
+    namespace: ENC[AES256_GCM,data:tfST672rcw==,iv:3wCjwSz9IzbdxPhqHbunAT/fauDIfc0mnfQm1Pa9r5s=,tag:Rx7/ZQWogr7YO8dwhUTdIA==,type:str]
+type: ENC[AES256_GCM,data:u8dtrvg4,iv:4VYYfdKpHemKG7BOY/K1pVEFdsN86+nCB4wvPqZ/fvk=,tag:QSgvuikMn+De+30r4rvlpw==,type:str]
+stringData:
+    token: ENC[AES256_GCM,data:ayPjLN1KmPCcNjZJOvxm1peWA5YNZWgBmfeT/cgRooeUjP9iZqY7Yw==,iv:z7iQfBGS/OyuQegnss/UX+kFwa0T9+n+iIR0D+SPjKs=,tag:UbQ9ubgtyPzyrkrIY7VG8Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwQzJXMzZyOFE1RGNDb3Yx
+            MTczdWRTOVQyYytiNEtKNjRrWE91WHdYenlJCkdIeThZVkZUVXlqdER0VktFWVcv
+            c2VlWVZHa1ZZYzRmVFNqVkx6Q1lDZjgKLS0tIDkrc082WVNuampWbEJyWHZtNWdX
+            R1dFZkRUUUxXaVNQa0VjMkVjdCtZVXMKnoqnxQCeAxlcjbek6Hxc0/sxMGt21zyn
+            oy2D7TbnffErbYIQzHJ3C0UBhryRVRg7Sqs5u9sDQrFz0OSdbdazlQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-07T18:54:46Z"
+    mac: ENC[AES256_GCM,data:N0hAtpHXhT8pKTSdWe3XJ6YZ9cw2LeKMNLnF2269unqKUaQouLIUo5aAaallxy9I0Jgdv3NzkI+pb88W0PqHu9I7MSSUeCcZUsGErjVEHfDx5xnuqqddUWJAgelyfMdvpQIa+mO3GN/hxLtDOrH96YPmUA1o4JBhLaJzD+BzmfE=,iv:fKYNo+WNOfX7op1LuxsD42hcPn9Q5ibEGCi/MGFXVJg=,tag:oQhRvuC4ihbCPxaTYOgnZQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4