Adopt Dagger CI for container builds (Phase 1) (#156)

## Summary

- Add Dagger Python module (`.dagger/`) with `build` and `publish` functions for container images
- Replace Docker buildx + skopeo composite action with `dagger call publish` in `build-container.yaml`
- BuildKit's native push is compatible with Zot — **skopeo workaround eliminated**
- Add Dagger CLI (v0.19.11) to forgejo-runner Dockerfile, bump runner to v2.6.0
- Bootstrap step in workflow curl-installs dagger if not in runner (for first build on v2.5.1 runner)
- Delete old `.forgejo/actions/build-push-image/` composite action
- Add GPLv3 LICENSE

## Verified locally

- `dagger call build --src=. --container-name=nettest` — builds ✓
- `dagger call publish --src=. --container-name=nettest --version=dagger-test` — pushed to Zot ✓
- `dagger call build --src=. --container-name=forgejo-runner` — new runner image builds ✓
- Dagger CLI accessible inside built runner image ✓

## Deployment sequence (after merge)

1. `mise run container-tag-and-release forgejo-runner v2.6.0` — old runner bootstraps dagger via curl, builds new runner
2. `argocd app sync forgejo-runner` — runner restarts with v2.6.0 (dagger baked in)
3. `mise run container-tag-and-release nettest v0.13.0` — end-to-end test of new pipeline
4. `mise run container-list` — verify tags

## Not included (future phases)

- Phase 2: docs build + Forgejo packages migration
- Phase 3: runner simplification (remove skopeo, Node.js, etc.)
- Phase 4: future workflows

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/156

docs/how-to/plans/adopt-dagger-ci.md

@@ -9,7 +9,7 @@ tags:
 
 # Plan: Adopt Dagger as CI/CD Build Engine
 
-> **Status:** Planned (not yet executed)
+> **Status:** Phase 1 implemented
 
 ## Background
 
@@ -488,10 +488,10 @@ BuildKit caches aggressively, making repeated builds fast. Since the Forgejo run
 ## Verification Checklist
 
 ### Phase 1 (Containers)
-- [ ] `dagger call build --src=. --container-name=nettest` succeeds locally
+- [x] `dagger call build --src=. --container-name=nettest` succeeds locally
 - [ ] `dagger call build --src=. --container-name=nettest terminal` drops into container shell
-- [ ] `dagger call publish --src=. --container-name=nettest --version=test` pushes to zot
-- [ ] Zot manifest compatibility confirmed (no skopeo needed) or fallback implemented
+- [x] `dagger call publish --src=. --container-name=nettest --version=test` pushes to zot
+- [x] Zot manifest compatibility confirmed (no skopeo needed) or fallback implemented
 - [ ] Tag-triggered Forgejo Action successfully calls `dagger call publish`
 - [ ] Existing `mise run container-tag-and-release` workflow still works end-to-end