ci: consume shared ci-python:3.14 image; bump runtime to 3.14

Migrate to the FabledRulebook CI-Runner contract:

- .forgejo/workflows/ci.yml: all four jobs (typecheck/lint/test/build)
  now schedule on the `python-ci` runner label and run inside
  container.image: git.fabledsword.com/bvandeusen/ci-python:3.14
  (Python 3.14 + Node 24 + ruff + uv + Docker CLI). Dropped the inline
  uv install in the test job — uv is now baked into the image.
- Dockerfile: production runtime bumped to python:3.14-slim so test
  results stay representative against what we ship.
- ci-requirements.md: new file at repo root declaring image deps and
  per-job installs (per FabledRulebook ci-runners.md).
- infra/Dockerfile.runner-base: deleted. The in-repo runner base
  (Ubuntu 24.04 + Python 3.12 + Node 22) is superseded by the shared
  ci-python image. The runner-host deployment files
  (runner-compose.yml + act-runner-config.yml) stay as deployment-shape
  documentation; source of truth is the deployed config.
- docs/development.md: CI/CD + Runner sections refreshed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/development.md

@@ -57,7 +57,9 @@ Migration conventions:
 
 ### Pipeline
 
-CI runs on Forgejo Actions with a custom runner base image (`py3.12-node22`):
+CI runs on Forgejo Actions, consuming the shared
+[`ci-python:3.14`](https://git.fabledsword.com/bvandeusen/CI-runner) image
+via `container.image` (Python 3.14 + Node 24 + ruff + uv + Docker CLI):
 
 | Trigger | Jobs | Docker tags pushed |
 |---------|------|--------------------|
@@ -77,13 +79,17 @@ CI runs on Forgejo Actions with a custom runner base image (`py3.12-node22`):
    git checkout dev && git merge main && git push origin dev
    ```
 
-### Custom Runner
+### Runner
 
-Runner base image: `infra/Dockerfile.runner-base` (Ubuntu 24.04 + Python 3.12 + Node 22 LTS).
-Runner config: `infra/act-runner-config.yml` (label: `py3.12-node22`).
-Runner compose: `infra/runner-compose.yml`.
+CI jobs schedule against the `python-ci` runner label and run inside the
+shared `git.fabledsword.com/bvandeusen/ci-python:3.14` image (see
+`ci-requirements.md` for what this project relies on from the image).
+The runner deployment lives outside this repo; image bumps happen in
+[CI-Runner](https://git.fabledsword.com/bvandeusen/CI-runner) via Renovate.
 
-To activate a new runner registration, copy `infra/act-runner-config.yml` to the runner's config directory, delete the `.runner` registration file in the runner container, and restart the stack.
+`infra/runner-compose.yml` + `infra/act-runner-config.yml` document the
+runner-host deployment shape; the source of truth is the deployed
+config on the runner host.
 
 ### Docker Registry