Simplify runner image (Dagger Phase 3) (#162)

## Summary

With Phases 1 and 2 complete, the runner image no longer needs most of its bundled tools. This PR strips it down and adds what was missing.

**Removed** (now inside Dagger containers):
- Node.js 24.x
- Docker CLI + buildx plugin
- skopeo
- gnupg, lsb-release, xz-utils

**Added:**
- `tzdata` — fixes the TZ env var (#159, #160, #161) so `TZ=America/Los_Angeles` actually works
- `flyctl` — was being installed from scratch every release

**Workflow changes:**
- Remove "Ensure Dagger CLI" bootstrap steps from both workflows (Dagger is in the image)
- Remove "Install flyctl" step from build-blumeops (flyctl is in the image)
- Remove job-level `TZ` from build-blumeops (moved to runner configmap `runner.envs`)
- Set `TZ: America/Los_Angeles` in runner configmap so all job containers inherit it

## Deployment

After merge:
1. Build and release the new runner image: `mise run container-release forgejo-runner v2.0.0`
2. Sync the runner: `argocd app sync forgejo-runner`
3. Verify: `kubectl -n forgejo-runner exec deploy/forgejo-runner -c runner -- date` (but the real test is running a docs release and checking the changelog date)

Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/162

.forgejo/workflows/build-container.yaml

@@ -68,18 +68,6 @@ jobs:
           echo ""
           echo "Skipping build."
 
-      - name: Ensure Dagger CLI
-        if: steps.check.outputs.exists == 'true'
-        run: |
-          # Bootstrap: install dagger if not already in the runner image.
-          # Remove once all runners include dagger (Phase 3).
-          if ! command -v dagger &>/dev/null; then
-            echo "Dagger not found, installing..."
-            curl -fsSL https://dl.dagger.io/dagger/install.sh | DAGGER_VERSION=0.19.11 sh
-            mv ./bin/dagger /usr/local/bin/dagger && rmdir ./bin
-          fi
-          dagger version
-
       - name: Publish
         if: steps.check.outputs.exists == 'true'
         run: |