Route runner daemon through nginx CF Access proxy

act_runner cannot inject custom HTTP headers, so CF Access blocks its
unauthenticated calls to git.neuralplatform.ai. Add a gitea-proxy
deployment (nginx:alpine) in the ci namespace that injects the CF
Access service-token headers and proxies to https://git.neuralplatform.ai.

Both runner secrets now point GITEA_INSTANCE_URL at the in-cluster proxy
(http://gitea-proxy.ci.svc.cluster.local:3000). Build containers still
clone via SSH through git-ssh-init.sh — unaffected.

servers/legion/k8s/gitea-runner/deployment.yaml

@@ -8,7 +8,7 @@ metadata:
   labels:
     app: gitea-runner
   annotations:
-    config-version: "2026-05-05-ssh-clone"
+    config-version: "2026-05-05-gitea-proxy"
 spec:
   replicas: 1
   selector:
@@ -19,7 +19,7 @@ spec:
       labels:
         app: gitea-runner
       annotations:
-        config-version: "2026-05-05-ssh-clone"
+        config-version: "2026-05-05-gitea-proxy"
     spec:
       securityContext:
         runAsNonRoot: false
@@ -100,7 +100,7 @@ metadata:
   labels:
     app: neuron-technologies-runner
   annotations:
-    config-version: "2026-05-05-ssh-clone"
+    config-version: "2026-05-05-gitea-proxy"
 spec:
   replicas: 2
   selector:
@@ -111,7 +111,7 @@ spec:
       labels:
         app: neuron-technologies-runner
       annotations:
-        config-version: "2026-05-05-ssh-clone"
+        config-version: "2026-05-05-gitea-proxy"
     spec:
       securityContext:
         runAsNonRoot: false