ci: consume shared ci-python:3.14 image; bump runtime to 3.14

Migrate to the FabledRulebook CI-Runner contract:

- .forgejo/workflows/ci.yml: all four jobs (typecheck/lint/test/build)
  now schedule on the `python-ci` runner label and run inside
  container.image: git.fabledsword.com/bvandeusen/ci-python:3.14
  (Python 3.14 + Node 24 + ruff + uv + Docker CLI). Dropped the inline
  uv install in the test job — uv is now baked into the image.
- Dockerfile: production runtime bumped to python:3.14-slim so test
  results stay representative against what we ship.
- ci-requirements.md: new file at repo root declaring image deps and
  per-job installs (per FabledRulebook ci-runners.md).
- infra/Dockerfile.runner-base: deleted. The in-repo runner base
  (Ubuntu 24.04 + Python 3.12 + Node 22) is superseded by the shared
  ci-python image. The runner-host deployment files
  (runner-compose.yml + act-runner-config.yml) stay as deployment-shape
  documentation; source of truth is the deployed config.
- docs/development.md: CI/CD + Runner sections refreshed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -64,7 +64,9 @@ jobs:
     name: TypeScript typecheck
     # Skip on main merge-commit pushes — see workflow header comment.
     if: github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')
-    runs-on: ci-runner
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
     steps:
       - uses: actions/checkout@v6
 
@@ -86,11 +88,13 @@ jobs:
   lint:
     name: Python lint
     if: github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')
-    runs-on: ci-runner
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
     steps:
       - uses: actions/checkout@v6
 
-      # ruff is pre-installed in the ci-runner base image — no install
+      # ruff is pre-installed in the ci-python image — no install
       # step needed, lint runs in ~2s.
       - name: Lint
         run: ruff check src/
@@ -98,7 +102,9 @@ jobs:
   test:
     name: Python tests
     if: github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')
-    runs-on: ci-runner
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
     steps:
       - uses: actions/checkout@v6
 
@@ -132,7 +138,9 @@ jobs:
     # pushes skip here too, so no production image is ever built from a
     # raw main push (only from the v* tag the release creates).
     if: github.ref == 'refs/heads/dev' || startsWith(github.ref, 'refs/tags/v')
-    runs-on: ci-runner
+    runs-on: python-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-python:3.14
     permissions:
       contents: read
       packages: write