feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

repo_variables.conf.example

@@ -0,0 +1,20 @@
+# =============================================================================
+# repo_variables.conf — Gitea Actions Repository Variables (INI format)
+# Copy to repo_variables.conf and edit.
+# Used by phase11_custom_runners.sh to set per-repo CI dispatch variables.
+# =============================================================================
+#
+# Each [section] = Gitea repository name (must exist in GITEA_ORG_NAME).
+# Keys = variable names. Values = literal string set via Gitea API.
+# Workflows access these as ${{ vars.VARIABLE_NAME }}.
+#
+# Common pattern: repos use fromJSON(vars.CI_RUNS_ON || '["ubuntu-latest"]')
+# in runs-on to dynamically select runners.
+
+#[my-go-repo]
+#CI_RUNS_ON = ["self-hosted","Linux","X64"]
+
+#[my-mobile-repo]
+#CI_RUNS_ON = ["self-hosted","Linux","X64"]
+#CI_RUNS_ON_MACOS = ["self-hosted","macOS","ARM64"]
+#CI_RUNS_ON_ANDROID = ["self-hosted","Linux","X64","android-emulator"]