feat: rework runner config to INI format with full field support

Replace pipe-delimited runners.conf with INI-style sections supporting
host resolution, container images, repo-scoped tokens, resource limits,
capacity, and SSH key passthrough. All defaults pulled from .env.

- Add INI parsing helpers (ini_list_sections, ini_get, ini_set) to common.sh
- Add SSH key support (UNRAID_SSH_KEY, FEDORA_SSH_KEY) to ssh_exec/scp_to
- Add .env vars: RUNNER_DEFAULT_IMAGE, RUNNER_DEFAULT_CAPACITY,
  RUNNER_DEFAULT_DATA_PATH, LOCAL_RUNNER_DATA_PATH, LOCAL_REGISTRY
- Rewrite manage_runner.sh with host/image/token resolution and resource limits
- Rewrite configure_runners.sh wizard for INI format with all 9 fields
- Update phase3 scripts to use ini_list_sections instead of pipe parsing
- Add runners.conf INI validation to preflight.sh (check 5b)
- Update templates to use resolved labels, capacity, and deploy resources

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

templates/docker-compose-runner.yml.tpl

@@ -7,9 +7,10 @@ services:
     restart: unless-stopped
     environment:
       - GITEA_INSTANCE_URL=${GITEA_INTERNAL_URL}
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_REG_TOKEN}
       - GITEA_RUNNER_NAME=${RUNNER_NAME}
-      - GITEA_RUNNER_LABELS=${RUNNER_LABELS}
+      - GITEA_RUNNER_LABELS=${RUNNER_LABELS_CSV}
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ${RUNNER_DATA_PATH}:/data
+${RUNNER_DEPLOY_RESOURCES}

templates/runner-config.yaml.tpl

@@ -5,8 +5,8 @@ log:
 runner:
   name: ${RUNNER_NAME}
   labels:
-    - "${RUNNER_LABELS}:docker://node:20-bookworm"
-  capacity: 1
+${RUNNER_LABELS_YAML}
+  capacity: ${RUNNER_CAPACITY}
   timeout: 3h
   insecure: false
   fetch_timeout: 5s