feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

hosts/unstable/isaiah/default.nix

@@ -13,6 +13,8 @@
     gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
     gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
     runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
+    # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+    # gitea-runner-isaiah.file = ../../../secrets/gitea-runner-isaiah.age;
   };
 
   boot = {
@@ -53,6 +55,12 @@
       enable = true;
       qemu = true;
     };
+    gitea-runner = {
+      enable = true;
+      labels = [ "self-hosted" "bare-metal" "host:isaiah" ];
+      # TODO: Greg add agenix secret at secrets/gitea-runner-isaiah.age
+      # tokenFile = config.age.secrets.gitea-runner-isaiah.path;
+    };
   };
 
   networking = {