CT workflows use runs-on:[self-hosted,linux,do,ct-forge,<app>]; runners need
those labels (runner labels must be a superset of job labels) or jobs never match.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Enable [actions] on all 3 forges (cloud-init). Add docker-compose.runners.yml:
3 act_runner containers (one per forge) co-located on com.uvlava.quinn.artifacts,
sharing the forges' docker net, executing repo .forgejo/workflows. Reg tokens are
runtime secrets (per-forge admin registration-token), never committed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
