feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

runners.conf.example

@@ -55,6 +55,11 @@
 #                   (starts at login, no sudo needed).
 #                   Ignored for docker runners.
 #
+#   container_options — Extra Docker flags for act_runner job containers.
+#                   Passed to the container.options field in act_runner config.
+#                   e.g. "--device=/dev/kvm" for KVM passthrough.
+#                   Empty = no extra flags. Ignored for native runners.
+#
 # STARTER ENTRIES (uncomment and edit):
 
 #[unraid-runner]