feat: Gitea Actions shell runners + flake-lock workflow

- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
  shell mode, with options for enable, instanceURL, name, labels, and
  tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
  appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
  midnight) that runs nix flake update and opens a PR if flake.lock
  changed, using GITEA_TOKEN secret for authentication.

Closes part of #15 (NixOS shell runners + flake-lock workflow).

modules/nixos/default.nix

@@ -8,6 +8,7 @@
     ./backup.nix
     ./ceph.nix
     ./db.nix
+    ./gitea-runner.nix
     ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix

modules/nixos/gitea-runner.nix

@@ -0,0 +1,88 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.greg.gitea-runner;
+in
+{
+  options.greg.gitea-runner = {
+    enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)";
+
+    instanceURL = lib.mkOption {
+      type = lib.types.str;
+      default = "https://src.thehellings.com";
+      description = "URL of the Gitea instance to connect to";
+    };
+
+    name = lib.mkOption {
+      type = lib.types.str;
+      default = config.networking.hostName;
+      description = "Name of the runner (defaults to hostname)";
+    };
+
+    labels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "self-hosted" ];
+      description = "Labels to assign to this runner";
+    };
+
+    tokenFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to a file containing the runner registration token (from agenix)";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.gitea-actions-runner ];
+
+    systemd.services.gitea-runner = {
+      description = "Gitea Actions Runner";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      environment = {
+        GITEA_INSTANCE_URL = cfg.instanceURL;
+        GITEA_RUNNER_NAME = cfg.name;
+        GITEA_RUNNER_LABELS = lib.concatStringsSep "," cfg.labels;
+        HOME = "/var/lib/gitea-runner";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        User = "gitea-runner";
+        Group = "gitea-runner";
+        StateDirectory = "gitea-runner";
+        WorkingDirectory = "/var/lib/gitea-runner";
+        ExecStartPre = pkgs.writeShellScript "gitea-runner-register" ''
+          set -euo pipefail
+          CONFIG_FILE="/var/lib/gitea-runner/.runner"
+          if [ ! -f "$CONFIG_FILE" ]; then
+            TOKEN="$(cat ${cfg.tokenFile})"
+            ${pkgs.gitea-actions-runner}/bin/act_runner register \
+              --no-interactive \
+              --instance "$GITEA_INSTANCE_URL" \
+              --token "$TOKEN" \
+              --name "$GITEA_RUNNER_NAME" \
+              --labels "$GITEA_RUNNER_LABELS"
+          fi
+        '';
+        ExecStart = "${pkgs.gitea-actions-runner}/bin/act_runner daemon";
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+    };
+
+    users.users.gitea-runner = {
+      isSystemUser = true;
+      group = "gitea-runner";
+      home = "/var/lib/gitea-runner";
+      createHome = true;
+      description = "Gitea Actions Runner service user";
+    };
+
+    users.groups.gitea-runner = { };
+  };
+}