refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/test_registry.py

@@ -22,7 +22,6 @@ class TestRunnerRegistry:
             host="10.0.0.1",
             user="ubuntu",
             key="/key",
-            mode="docker",
             gitea_url="https://git.example.com",
             labels="docker:docker://alpine:latest",
         )
@@ -31,7 +30,6 @@ class TestRunnerRegistry:
         assert info["host"] == "10.0.0.1"
         assert info["user"] == "ubuntu"
         assert info["key"] == "/key"
-        assert info["mode"] == "docker"
         assert info["gitea_url"] == "https://git.example.com"
         assert info["labels"] == "docker:docker://alpine:latest"
         assert "created_at" in info