- Add modules/nixos/gitea-runner.nix: NixOS module for act_runner in
shell mode, with options for enable, instanceURL, name, labels, and
tokenFile (agenix secret path).
- Deploy gitea-runner to jeremiah, isaiah, zeke, and linode with
appropriate labels. Agenix secret placeholders left with TODOs.
- Add .gitea/workflows/update-flake-lock.yaml: weekly workflow (Sunday
midnight) that runs nix flake update and opens a PR if flake.lock
changed, using GITEA_TOKEN secret for authentication.
Closes part of #15 (NixOS shell runners + flake-lock workflow).
klaatuandroot
de1ec998e6