runner: bind-mount host kubectl into job containers; registry domain → neuralplatform.ai

gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.

ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.

servers/legion/apps/gitea-runner.yaml

@@ -38,6 +38,7 @@ spec:
                 network: host
                 docker_host: "unix:///var/run/docker.sock"
                 force_pull: false
+                options: -v /usr/local/bin/kubectl:/usr/local/bin/kubectl:ro
               EOF
           envFrom:
             - secretRef: