refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea-runner/molecule/update/converge.yml

@@ -1,23 +1,11 @@
 ---
-- name: Converge Docker mode
+- name: Converge
   hosts: all
   become: true
   vars:
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
-    runner_name: "update-docker-runner"
-    skip_runner_registration: true
-  roles:
-    - role: gitea-runner
-
-- name: Converge Binary mode
-  hosts: all
-  become: true
-  vars:
-    gitea_url: "http://localhost:3000"
-    registration_token: "fake-token-for-testing"
-    runner_name: "update-binary-runner"
-    runner_mode: "binary"
+    runner_name: "update-test-runner"
     skip_runner_registration: true
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/update/side_effect.yml

@@ -1,24 +1,11 @@
 ---
-- name: Update Docker mode runner
+- name: Update runner
   hosts: all
   become: true
   vars:
-    runner_name: "update-docker-runner"
-    runner_mode: "docker"
+    runner_name: "update-test-runner"
   tasks:
-    - name: Include Docker update tasks
+    - name: Include update tasks
       ansible.builtin.include_role:
         name: gitea-runner
-        tasks_from: docker_update.yml
-
-- name: Update Binary mode runner
-  hosts: all
-  become: true
-  vars:
-    runner_name: "update-binary-runner"
-    runner_mode: "binary"
-  tasks:
-    - name: Include binary update tasks
-      ansible.builtin.include_role:
-        name: gitea-runner
-        tasks_from: binary_update.yml
+        tasks_from: update_runner.yml

ansible/roles/gitea-runner/molecule/update/verify.yml

@@ -2,23 +2,14 @@
 - name: Verify
   hosts: all
   become: true
+  vars:
+    runner_name: "update-test-runner"
   pre_tasks:
     - name: Load role defaults
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
   tasks:
-    - name: Check Docker runner image still exists after update
-      ansible.builtin.command: docker images gitea/runner --format '{{ '{{' }} .Repository {{ '}}' }}:{{ '{{' }} .Tag {{ '}}' }}'
-      register: image_list
-      changed_when: false
-
-    - name: Assert runner image exists after update
-      ansible.builtin.assert:
-        that:
-          - "'gitea/runner' in image_list.stdout"
-        fail_msg: "Runner Docker image missing after update"
-
-    - name: Check binary runner executable still exists after update
+    - name: Check runner binary still exists after update
       ansible.builtin.stat:
         path: "{{ gitea_runner_binary_path }}"
       register: binary_stat
@@ -27,48 +18,26 @@
       ansible.builtin.assert:
         that:
           - binary_stat.stat.exists
-        fail_msg: "Binary runner executable missing after update"
+        fail_msg: "Runner binary missing after update"
 
-    - name: Check Docker mode systemd template still exists
+    - name: Check systemd user service still exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-docker@.service"
-      register: docker_service_stat
+        path: "{{ gitea_runner_home }}/.config/systemd/user/gitea-runner.service"
+      register: service_stat
 
-    - name: Assert Docker mode systemd template still exists after update
+    - name: Assert user service exists after update
       ansible.builtin.assert:
         that:
-          - docker_service_stat.stat.exists
-        fail_msg: "Docker mode systemd template missing after update"
+          - service_stat.stat.exists
+        fail_msg: "Systemd user service missing after update"
 
-    - name: Check Binary mode systemd template still exists
+    - name: Check instance data directory still exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-binary@.service"
-      register: binary_service_stat
+        path: "{{ gitea_runner_data_dir }}"
+      register: data_stat
 
-    - name: Assert Binary mode systemd template still exists after update
+    - name: Assert data directory exists after update
       ansible.builtin.assert:
         that:
-          - binary_service_stat.stat.exists
-        fail_msg: "Binary mode systemd template missing after update"
-
-    - name: Check Docker mode data directory still exists
-      ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/update-docker-runner"
-      register: docker_data_stat
-
-    - name: Assert Docker mode data directory exists after update
-      ansible.builtin.assert:
-        that:
-          - docker_data_stat.stat.exists
-        fail_msg: "Docker runner data directory missing after update"
-
-    - name: Check Binary mode data directory still exists
-      ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/update-binary-runner"
-      register: binary_data_stat
-
-    - name: Assert Binary mode data directory exists after update
-      ansible.builtin.assert:
-        that:
-          - binary_data_stat.stat.exists
-        fail_msg: "Binary runner data directory missing after update"
+          - data_stat.stat.exists
+        fail_msg: "Runner data directory missing after update"