feat: move GitHub Actions runner to Docker container

- Replace host systemd runner with myoung34/github-runner container
  in the main compose stack
- Mounts docker.sock (GID 1001), /valhalla-lab, and /config/caddy
  so the workflow can deploy compose and reload Caddy without SSH
- Update deploy.yml to write files via mounted paths and use a shared
  COMPOSE env var for cleaner step commands
- Add GITHUB_RUNNER_ACCESS_TOKEN placeholder to .env (fine-grained PAT
  with Administration:write needed for runner self-registration)

.github/workflows/deploy.yml

@@ -6,6 +6,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  COMPOSE: docker compose -f /valhalla-lab/docker-compose.yml --env-file /valhalla-lab/.env
 
 jobs:
   deploy:
@@ -14,20 +15,17 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Push .env
-        run: cp .env ~/valhalla-lab/.env
-
-      - name: Push and apply compose
+      - name: Push .env + compose
         run: |
-          cp docker-compose.yml ~/valhalla-lab/docker-compose.yml
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env pull
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env up -d
+          cp .env /valhalla-lab/.env
+          cp docker-compose.yml /valhalla-lab/docker-compose.yml
 
-      - name: Push and reload Caddyfile
+      - name: Pull and apply compose
+        run: |
+          $COMPOSE pull
+          $COMPOSE up -d
+
+      - name: Reload Caddyfile
         run: |
           cp Caddyfile /config/caddy/Caddyfile
-          docker compose -f ~/valhalla-lab/docker-compose.yml \
-            --env-file ~/valhalla-lab/.env exec -T caddy \
-            caddy reload --config /etc/caddy/Caddyfile
+          $COMPOSE exec -T caddy caddy reload --config /etc/caddy/Caddyfile