feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -96,6 +96,11 @@ LOCAL_REGISTRY=                   # Local registry prefix (e.g. registry.local:5
 # AUTO-POPULATED by phase3 scripts — do not fill manually:
 GITEA_RUNNER_REGISTRATION_TOKEN=  # Retrieved from Gitea admin panel via API
 
+# Custom runner image build contexts (phase 11)
+# Absolute paths to directories containing Dockerfiles for custom runner images.
+GO_NODE_RUNNER_CONTEXT=           # Path to Go + Node toolchain Dockerfile (e.g. /path/to/augur/infra/runners)
+JVM_ANDROID_RUNNER_CONTEXT=       # Path to JDK + Android SDK toolchain Dockerfile (e.g. /path/to/periodvault/infra/runners)
+
 
 # -----------------------------------------------------------------------------
 # REPOSITORIES