ci: fix gitea runner URL and set DEFAULT_ACTIONS_URL

- external-secrets.yaml: GITEA_INSTANCE_URL changed from cluster-internal
  URL to https://git.neuralplatform.ai so runner can register externally
- gitea.yaml: add GITEA__actions__DEFAULT_ACTIONS_URL=gitea so all
  actions/* references resolve from gitea.com, not github.com
- Dockerfile: track runner image (Python 3.12 + build deps) in repo

servers/legion/k8s/gitea-runner/Dockerfile

@@ -0,0 +1,19 @@
+FROM gitea/act_runner:latest
+
+USER root
+
+RUN apk add --no-cache \
+    bash \
+    git \
+    curl \
+    nodejs \
+    npm \
+    python3 \
+    py3-pip \
+    python3-dev \
+    gcc \
+    musl-dev \
+    linux-headers \
+    make && \
+    ln -sf /usr/bin/node /usr/local/bin/node && \
+    ln -sf /usr/bin/npm /usr/local/bin/npm