feat: move GitHub Actions runner to Docker container

- Replace host systemd runner with myoung34/github-runner container
  in the main compose stack
- Mounts docker.sock (GID 1001), /valhalla-lab, and /config/caddy
  so the workflow can deploy compose and reload Caddy without SSH
- Update deploy.yml to write files via mounted paths and use a shared
  COMPOSE env var for cleaner step commands
- Add GITHUB_RUNNER_ACCESS_TOKEN placeholder to .env (fine-grained PAT
  with Administration:write needed for runner self-registration)

docker-compose.yml

@@ -595,6 +595,22 @@ services:
       - /config/homarr/icons:/app/public/icons
       - /config/homarr/data:/data
 
+  github-runner:
+    container_name: github_runner
+    image: myoung34/github-runner:latest
+    restart: unless-stopped
+    environment:
+      - ACCESS_TOKEN=${GITHUB_RUNNER_ACCESS_TOKEN}
+      - REPO_URL=https://github.com/ginnoir/homelabstack
+      - RUNNER_NAME=valhalla
+      - RUNNER_LABELS=self-hosted,Linux,x64
+      - RUNNER_SCOPE=repo
+      - DOCKER_GROUP_GID=1001
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /home/ginnoir/valhalla-lab:/valhalla-lab
+      - /config/caddy:/config/caddy
+
   # ============================================================
   # UTILITIES
   # ============================================================