Replaces cachix/install-nix-action and stefanzweifel/git-auto-commit-action
with inline shell so the workflow no longer touches github.com. Still pulls
the runner image from Docker Hub and the install script from nixos.org —
those are deliberately left for now and can be cut in a follow-up.
actions/checkout stays because it's mirrored on data.forgejo.org and the
runner already resolves it there.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds services/forgejo-runner.nix as a host-gated module on the mediaserver
and switches the flake-update workflow from runs-on: ubuntu-latest to the
self-hosted fred-nix label, mapped to catthehacker/ubuntu:act-latest for
GitHub-action compatibility. Token lives at /var/secrets/forgejo-runner-token
so it stays out of the Nix store.
Also drops the stray result/ build symlink from the worktree.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
