FORGEJO_URL, RUNNER_NAME, and RUNNER_LABELS are not secrets — they were
bundled into the ExternalSecret template for convenience. Moving them to
the deployment spec means changing the image version (in RUNNER_LABELS)
will trigger an automatic pod rollout instead of requiring a manual restart.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>