Prepare forgejo-runner v12 upgrade (leaf nodes) (#250)

## Summary
- Review runner config against v12.7.0 defaults — added `shutdown_timeout: 3h`, no breaking changes found
- Add `validate_workflows` Dagger function using `forgejo-runner validate --directory .` inside upstream container
- All 6 workflows pass v12.7.0 schema validation
- Wire `mise run validate-workflows` task and pre-commit hook on `.forgejo/workflows/` changes
- Mark both leaf Mikado cards (`review-runner-config-v12`, `validate-workflows-against-v12`) complete

## Mikado State
After merge, `upgrade-k8s-runner` goal card has no unmet dependencies — ready to execute the actual image bump in a follow-up PR.

## Test Plan
- [x] `dagger call validate-workflows --src=.` passes (all 6 workflows OK)
- [x] Pre-commit hooks pass
- [ ] Reviewer: confirm `shutdown_timeout: 3h` addition to ConfigMap looks reasonable

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/250

argocd/manifests/forgejo-runner/configmap.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: forgejo-runner
 data:
   config.yaml: |
+    # Reviewed against v12.7.0 defaults (2026-02-22)
     log:
       level: info
 
@@ -12,6 +13,7 @@ data:
       file: /data/.runner
       capacity: 2
       timeout: 3h
+      shutdown_timeout: 3h
       # Env vars injected into all job containers
       envs:
         DOCKER_HOST: tcp://127.0.0.1:2375