ci: fix gitea runner URL and set DEFAULT_ACTIONS_URL

- external-secrets.yaml: GITEA_INSTANCE_URL changed from cluster-internal
  URL to https://git.neuralplatform.ai so runner can register externally
- gitea.yaml: add GITEA__actions__DEFAULT_ACTIONS_URL=gitea so all
  actions/* references resolve from gitea.com, not github.com
- Dockerfile: track runner image (Python 3.12 + build deps) in repo

servers/legion/apps/gitea.yaml

@@ -59,6 +59,8 @@ spec:
               value: "true"
             - name: GITEA__webhook__ALLOWED_HOST_LIST
               value: 192.168.0.0/24,10.0.0.0/8
+            - name: GITEA__actions__DEFAULT_ACTIONS_URL
+              value: gitea
           volumeMounts:
             - name: data
               mountPath: /data

servers/legion/k8s/gitea-runner/Dockerfile

@@ -0,0 +1,19 @@
+FROM gitea/act_runner:latest
+
+USER root
+
+RUN apk add --no-cache \
+    bash \
+    git \
+    curl \
+    nodejs \
+    npm \
+    python3 \
+    py3-pip \
+    python3-dev \
+    gcc \
+    musl-dev \
+    linux-headers \
+    make && \
+    ln -sf /usr/bin/node /usr/local/bin/node && \
+    ln -sf /usr/bin/npm /usr/local/bin/npm

servers/legion/k8s/gitea-runner/external-secrets.yaml

@@ -16,7 +16,7 @@ spec:
     creationPolicy: Owner
     template:
       data:
-        GITEA_INSTANCE_URL: "http://gitea.git.svc.cluster.local:3000"
+        GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
   data:
     - secretKey: runner_token