refactor: move runner+watchtower to portainer-compose (management plane)

- portainer-compose.yml now owns all three management-plane services:
  portainer, github-runner, watchtower. All mount the docker socket;
  none belong to the application stack.
- Watchtower carries over its existing env (DOCKER_API_VERSION, ntfy URL).
  portainer, runner, and watchtower itself are labeled to opt out of
  watchtower auto-updates.
- docker-compose.yml: remove github-runner (was causing self-kill during
  dc up -d; exclusion workaround no longer needed)
- deploy.yml: simplified back to plain dc up -d with no service filtering

docker-compose.yml

@@ -595,22 +595,6 @@ services:
       - /config/homarr/icons:/app/public/icons
       - /config/homarr/data:/data
 
-  github-runner:
-    container_name: github_runner
-    image: myoung34/github-runner:latest
-    restart: unless-stopped
-    environment:
-      - ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
-      - REPO_URL=https://github.com/ginnoir/homelabstack
-      - RUNNER_NAME=valhalla
-      - RUNNER_LABELS=self-hosted,Linux,x64
-      - RUNNER_SCOPE=repo
-      - DOCKER_GROUP_GID=1001
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - /home/ginnoir/valhalla-lab:/valhalla-lab
-      - /config/caddy:/config/caddy
-
   # ============================================================
   # UTILITIES
   # ============================================================