refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea-runner/molecule/default/verify.yml

@@ -9,42 +9,39 @@
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check Docker is installed
-      ansible.builtin.command: docker --version
-      changed_when: false
+    - name: Check runner user exists
+      ansible.builtin.user:
+        name: "{{ gitea_runner_service_user }}"
+      register: user_info
+      check_mode: true
 
-    - name: Check runner image was pulled
-      ansible.builtin.command: docker images gitea/runner --format '{{ '{{' }} .Repository {{ '}}' }}:{{ '{{' }} .Tag {{ '}}' }}'
-      register: image_list
-      changed_when: false
-
-    - name: Assert runner image exists locally
+    - name: Assert runner user exists
       ansible.builtin.assert:
         that:
-          - "'gitea/runner' in image_list.stdout"
-        fail_msg: "Runner Docker image was not pulled"
+          - user_info.state == "present"
+        fail_msg: "Runner system user was not created"
 
-    - name: Check prune timer exists
+    - name: Check runner binary exists
       ansible.builtin.stat:
-        path: /etc/systemd/system/docker-prune.timer
-      register: timer_stat
+        path: "{{ gitea_runner_binary_path }}"
+      register: binary_stat
 
-    - name: Assert prune timer exists
+    - name: Assert runner binary exists
       ansible.builtin.assert:
         that:
-          - timer_stat.stat.exists
-        fail_msg: "Docker prune timer is missing"
+          - binary_stat.stat.exists
+        fail_msg: "Gitea runner binary is missing"
 
-    - name: Check systemd template unit exists
+    - name: Check systemd user service exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
       register: service_stat
 
-    - name: Assert template unit exists
+    - name: Assert user service exists
       ansible.builtin.assert:
         that:
           - service_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
+        fail_msg: "Systemd user service is missing"
 
     - name: Check instance data directory exists
       ansible.builtin.stat:
@@ -57,9 +54,9 @@
           - data_dir_stat.stat.exists
         fail_msg: "Instance data directory is missing"
 
-    - name: Check config file exists in data directory
+    - name: Check config file exists in config directory
       ansible.builtin.stat:
-        path: "{{ gitea_runner_data_dir }}/config.yaml"
+        path: "{{ gitea_runner_config_dir }}/config.yaml"
       register: config_stat
 
     - name: Assert config file exists
@@ -67,3 +64,14 @@
         that:
           - config_stat.stat.exists
         fail_msg: "Config file is missing"
+
+    - name: Check prune timer exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_home }}/.config/systemd/user/docker-prune.timer"
+      register: timer_stat
+
+    - name: Assert prune timer exists
+      ansible.builtin.assert:
+        that:
+          - timer_stat.stat.exists
+        fail_msg: "Docker prune timer is missing"