refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/status-runner.yml

@@ -9,19 +9,19 @@
         name: gitea-runner
         tasks_from: systemd_check.yml
 
-    - name: Check systemd status
-      ansible.builtin.systemd:
-        name: "gitea-runner@{{ runner_name }}"
+    - name: Check systemd user service status
+      ansible.builtin.command: systemctl --user is-active gitea-runner
+      become: true
+      become_user: "{{ gitea_runner_service_user | default('grm-' ~ runner_name) }}"
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid | default('') }}"
       register: service_status
+      changed_when: false
       when: systemd_available.stat.exists
 
-    - name: Report systemd status
+    - name: Report service status
       ansible.builtin.debug:
-        msg: >
-          Service gitea-runner@{{ runner_name }}:
-          ActiveState={{ service_status.status.ActiveState | default('unknown') }},
-          SubState={{ service_status.status.SubState | default('unknown') }},
-          LoadState={{ service_status.status.LoadState | default('unknown') }}
+        msg: "Service gitea-runner: {{ service_status.stdout | default('unknown') | trim }}"
       when: systemd_available.stat.exists
 
     - name: Check runner registration file
@@ -32,15 +32,3 @@
     - name: Report runner registration
       ansible.builtin.debug:
         msg: "Runner registration file exists: {{ runner_file_stat.stat.exists | default(false) }}"
-
-    - name: Check container status (Docker mode)
-      ansible.builtin.shell: |
-        docker ps --filter "name=gitea-runner-{{ runner_name }}" --format "{{ '{{.Status}}' }}"
-      register: docker_check
-      changed_when: false
-      when: runner_mode | default('docker') == 'docker'
-
-    - name: Report container status
-      ansible.builtin.debug:
-        msg: "Container status: {{ docker_check.stdout | default('not running') }}"
-      when: runner_mode | default('docker') == 'docker'