GRM-19: add molecule tests for template content, deregister, and update workflows

- template-content: Verifies rendered systemd template contains correct
  directives for docker mode (Type=oneshot, RemainAfterExit=yes) and
  prune service/timer content.
- deregister: Installs runner, creates fake .runner file, runs deregister
  tasks, verifies .runner file is removed.
- update: Installs docker and binary runners, runs update tasks, verifies
  image/binary and data directories remain intact after update.

These scenarios bridge gaps where the deregister task file and update
workflows were not covered by existing molecule tests.

ansible/roles/gitea-runner/molecule/update/side_effect.yml

@@ -0,0 +1,24 @@
+---
+- name: Update Docker mode runner
+  hosts: all
+  become: true
+  vars:
+    runner_name: "update-docker-runner"
+    runner_mode: "docker"
+  tasks:
+    - name: Include Docker update tasks
+      ansible.builtin.include_role:
+        name: gitea-runner
+        tasks_from: docker_update.yml
+
+- name: Update Binary mode runner
+  hosts: all
+  become: true
+  vars:
+    runner_name: "update-binary-runner"
+    runner_mode: "binary"
+  tasks:
+    - name: Include binary update tasks
+      ansible.builtin.include_role:
+        name: gitea-runner
+        tasks_from: binary_update.yml