feat: rework runner config to INI format with full field support

Replace pipe-delimited runners.conf with INI-style sections supporting
host resolution, container images, repo-scoped tokens, resource limits,
capacity, and SSH key passthrough. All defaults pulled from .env.

- Add INI parsing helpers (ini_list_sections, ini_get, ini_set) to common.sh
- Add SSH key support (UNRAID_SSH_KEY, FEDORA_SSH_KEY) to ssh_exec/scp_to
- Add .env vars: RUNNER_DEFAULT_IMAGE, RUNNER_DEFAULT_CAPACITY,
  RUNNER_DEFAULT_DATA_PATH, LOCAL_RUNNER_DATA_PATH, LOCAL_REGISTRY
- Rewrite manage_runner.sh with host/image/token resolution and resource limits
- Rewrite configure_runners.sh wizard for INI format with all 9 fields
- Update phase3 scripts to use ini_list_sections instead of pipe parsing
- Add runners.conf INI validation to preflight.sh (check 5b)
- Update templates to use resolved labels, capacity, and deploy resources

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

runners.conf.example

@@ -1,20 +1,82 @@
 # =============================================================================
-# runners.conf — Gitea Actions Runner Definitions
-# Copy to runners.conf and edit. One runner per line.
+# runners.conf — Gitea Actions Runner Definitions (INI format)
+# Copy to runners.conf and edit, or generate interactively with:
+#   ./setup/configure_runners.sh
 # Use manage_runner.sh to add/remove runners dynamically.
 # =============================================================================
 #
-# FORMAT: name|ssh_host|ssh_user|ssh_port|data_path|labels|type
+# Each [section] defines one runner. Section name = runner display name in Gitea.
 #
-#   name       — Display name in Gitea admin panel
-#   ssh_host   — IP address or hostname (for local machine, use "local")
-#   ssh_user   — SSH username (ignored if ssh_host is "local")
-#   ssh_port   — SSH port (ignored if ssh_host is "local")
-#   data_path  — Absolute path for runner binary + data on that machine
-#   labels     — Comma-separated runner labels (used in workflow runs-on)
-#   type       — "docker" (Linux, runs jobs in containers) or "native" (macOS, runs jobs on host)
+# FIELD REFERENCE:
 #
-# EXAMPLES:
-unraid-runner|192.168.1.10|root|22|/mnt/nvme/gitea-runner|linux|docker
-fedora-runner|192.168.1.20|user|22|/mnt/nvme/gitea-runner|linux|docker
-macbook-runner|local|_|_|~/gitea-runner|macos|native
+#   host          — enum: unraid, fedora, local, custom
+#                   Known hosts resolve SSH from .env (IP, user, port, key).
+#                   "local" runs on this machine. "custom" requires extra keys
+#                   in the section: ssh_host, ssh_user, ssh_port, ssh_key.
+#
+#   type          — enum: docker, native
+#                   "docker" = Linux container on remote host via Docker Compose.
+#                   "native" = macOS binary + launchd on local machine.
+#
+#   data_path     — Absolute path (/ or ~/) where act_runner stores its binary,
+#                   config, and job cache. NOT Gitea's data path.
+#                   Default: RUNNER_DEFAULT_DATA_PATH (docker), LOCAL_RUNNER_DATA_PATH (native)
+#
+#   labels        — Workflow runs-on value (e.g. linux, macos, ubuntu-latest).
+#                   Combined with default_image at deploy time to produce
+#                   act_runner label spec: "linux:docker://image" or "macos:host".
+#
+#   default_image — Docker image for job execution (docker runners only).
+#                   Default: RUNNER_DEFAULT_IMAGE from .env.
+#                   If LOCAL_REGISTRY is set, resolved as LOCAL_REGISTRY/image.
+#                   Leave empty for native runners.
+#
+#   repos         — Token hint (not an act_runner setting): controls which
+#                   registration token manage_runner.sh fetches at deploy time.
+#                   "all" = instance-level token (runner available to all repos).
+#                   Repo name = fetch repo-level token from Gitea API.
+#
+#   capacity      — Positive integer (>= 1). Max concurrent jobs.
+#                   Default: RUNNER_DEFAULT_CAPACITY from .env.
+#                   Constrained by host CPU/RAM. 0 and negative are invalid.
+#
+#   cpu           — Docker CPU limit (e.g. 2.0, 0.5). Ignored for native.
+#                   Empty = no limit.
+#
+#   memory        — Docker memory limit (e.g. 2g, 512m). Ignored for native.
+#                   Empty = no limit.
+#
+# STARTER ENTRIES (uncomment and edit):
+
+#[unraid-runner]
+#host          = unraid
+#type          = docker
+#data_path     = /mnt/nvme/gitea-runner
+#labels        = linux
+#default_image = catthehacker/ubuntu:act-latest
+#repos         = all
+#capacity      = 1
+#cpu           =
+#memory        =
+
+#[fedora-runner]
+#host          = fedora
+#type          = docker
+#data_path     = /mnt/nvme/gitea-runner
+#labels        = linux
+#default_image = catthehacker/ubuntu:act-latest
+#repos         = all
+#capacity      = 1
+#cpu           =
+#memory        =
+
+#[macbook-runner]
+#host          = local
+#type          = native
+#data_path     = ~/gitea-runner
+#labels        = macos
+#default_image =
+#repos         = all
+#capacity      = 1
+#cpu           =
+#memory        =