feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

toggle_dns.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Toggle DNS between Pi-hole and Cloudflare on all active network services.
+# Usage: ./toggle_dns.sh
+# Requires sudo for networksetup.
+
+PIHOLE="pi.sintheus.com"
+CLOUDFLARE="1.1.1.1"
+
+# Get all hardware network services (Wi-Fi, Ethernet, Thunderbolt, USB, etc.)
+services=()
+while IFS= read -r line; do
+  [[ "$line" == *"*"* ]] && continue  # skip disabled services
+  services+=("$line")
+done < <(networksetup -listallnetworkservices 2>/dev/null | tail -n +2)
+
+if [[ ${#services[@]} -eq 0 ]]; then
+  echo "No network services found"
+  exit 1
+fi
+
+# Detect current mode from the first service that has a DNS set
+current_dns=""
+for svc in "${services[@]}"; do
+  dns=$(networksetup -getdnsservers "$svc" 2>/dev/null | head -1)
+  if [[ "$dns" != *"aren't any"* ]] && [[ -n "$dns" ]]; then
+    current_dns="$dns"
+    break
+  fi
+done
+
+if [[ "$current_dns" == "$CLOUDFLARE" ]]; then
+  target="$PIHOLE"
+  label="Pi-hole"
+else
+  target="$CLOUDFLARE"
+  label="Cloudflare"
+fi
+
+echo "Switching all services to ${label} (${target})..."
+for svc in "${services[@]}"; do
+  sudo networksetup -setdnsservers "$svc" "$target"
+  echo "  ${svc} → ${target}"
+done
+
+sudo dscacheutil -flushcache
+sudo killall -HUP mDNSResponder 2>/dev/null || true
+echo "DNS set to ${label} (${target})"