feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/runner-config.yaml.tpl

@@ -1,5 +1,5 @@
 # act_runner configuration — rendered by manage_runner.sh
-# Variables: RUNNER_NAME, RUNNER_LABELS_YAML, RUNNER_CAPACITY
+# Variables: RUNNER_NAME, RUNNER_LABELS_YAML, RUNNER_CAPACITY, RUNNER_CONTAINER_OPTIONS
 # Deployed alongside docker-compose.yml (docker) or act_runner binary (native).
 
 log:
@@ -22,7 +22,7 @@ cache:
 container:
   network: ""                   # Empty = use default Docker network.
   privileged: false             # Never run job containers as privileged.
-  options:
+  options: ${RUNNER_CONTAINER_OPTIONS}
   workdir_parent:
 
 host: