refactor: move runner+watchtower to portainer-compose (management plane)

- portainer-compose.yml now owns all three management-plane services:
  portainer, github-runner, watchtower. All mount the docker socket;
  none belong to the application stack.
- Watchtower carries over its existing env (DOCKER_API_VERSION, ntfy URL).
  portainer, runner, and watchtower itself are labeled to opt out of
  watchtower auto-updates.
- docker-compose.yml: remove github-runner (was causing self-kill during
  dc up -d; exclusion workaround no longer needed)
- deploy.yml: simplified back to plain dc up -d with no service filtering

.github/workflows/deploy.yml

@@ -23,10 +23,7 @@ jobs:
       - name: Pull and apply compose
         run: |
           $COMPOSE pull
-          # Exclude github-runner from up -d — recreating the container that
-          # is running this job would kill the workflow mid-step.
-          SERVICES=$($COMPOSE config --services | grep -v '^github-runner$' | tr '\n' ' ')
-          $COMPOSE up -d $SERVICES
+          $COMPOSE up -d
 
       - name: Reload Caddyfile
         run: |