Reorganize CI/CD bootstrap phases and add custom runner Dockerfile (#50)

## Summary
- Reorder CI/CD bootstrap phases to address chicken-and-egg problem
- P2 is now "Custom Runner Image" (stock runner lacks Node.js)
- Add P3 for "Mirror Forgejo & Build from Source"
- Rename P3 -> P4 (Self-Deploy), P4 -> P5 (Container Builds)
- Add Dockerfile for custom runner with Node.js, npm, docker, build tools
- Update overview with new phase structure, host mode notes, and cross-compilation challenge

## Key Changes

### Phase Reordering
| Old | New | Name |
|-----|-----|------|
| P1 | P1 | Enable Actions (complete) |
| P2 | P2 | **Custom Runner Image** (new focus) |
| - | P3 | **Mirror Forgejo & Build** (new) |
| P3 | P4 | Self-Deploy |
| P4 | P5 | Container Builds |

### Custom Runner Dockerfile
The stock `forgejo/runner:3.5.1` image lacks Node.js, so `actions/checkout@v4` doesn't work. The new Dockerfile adds:
- Node.js + npm (for GitHub Actions)
- Docker CLI (for container builds)
- Build tools (gcc, make, curl, jq)

### Bootstrap Strategy
1. Build custom runner image manually on gilbert (podman build)
2. Push to zot registry
3. Update deployment to use custom image
4. Then enable auto-build workflow for runner

## Deployment and Testing
- [x] Review plan changes
- [x] Build custom runner image manually and verify
- [x] Update runner deployment
- [x] Test `actions/checkout@v4` works

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: https://forge.tail8d86e.ts.net/eblume/blumeops/pulls/50

argocd/manifests/forgejo-runner/Dockerfile

@@ -0,0 +1,29 @@
+FROM code.forgejo.org/forgejo/runner:3.5.1
+
+# Switch to root to install packages
+USER root
+
+# The base image is Alpine Linux
+# Install tools needed for GitHub Actions and builds
+RUN apk add --no-cache \
+    # Required for actions/checkout and other Node-based actions
+    nodejs \
+    npm \
+    # Build essentials
+    git \
+    curl \
+    wget \
+    jq \
+    make \
+    gcc \
+    g++ \
+    musl-dev \
+    # For container builds
+    ca-certificates \
+    docker-cli
+
+# Verify tools are available
+RUN node --version && npm --version && docker --version
+
+# Switch back to non-root user
+USER 1000

argocd/manifests/forgejo-runner/deployment.yaml

@@ -16,7 +16,7 @@ spec:
       serviceAccountName: forgejo-runner
       containers:
         - name: runner
-          image: code.forgejo.org/forgejo/runner:3.5.1
+          image: registry.tail8d86e.ts.net/blumeops/forgejo-runner:latest
           env:
             # Use internal k8s service via Tailscale operator egress
             - name: FORGEJO_INSTANCE_URL