Scope CI/CD to build+test only; clean up runner infra

Remove automated deploy — Portainer handles deployments for now.
build.yml: deploy job removed, only builds and pushes image to registry.
infra/runner-compose.yml: clean standalone Portainer stack for act_runner,
  no swarm network dependency, uses external Forgejo URL.
infra/runner-swarm.yml: removed (replaced by runner-compose.yml).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/act-runner-config.yml

@@ -1,15 +1,12 @@
-# act_runner configuration — stored as a Docker Swarm Config object.
-# Referenced in runner-swarm.yml under configs.act_runner_config.
-#
-# After changing this file, update the swarm config:
-#   docker config rm act_runner_config
-#   docker stack deploy -c forgejo-stack.yml forgejo  (or docker compose up -d)
+# act_runner configuration.
+# Place this file at: /nfs/data/fabledsword/act_runner/config.yml
+# It is bind-mounted read-only into the runner container.
 
 log:
   level: info
 
 runner:
-  capacity: 2   # concurrent jobs
+  capacity: 2   # max concurrent jobs
   timeout: 30m
 
 cache:
@@ -17,11 +14,12 @@ cache:
   dir: /data/.cache
 
 container:
-  # bridge: job containers get internet access via NAT but are isolated from
-  # each other and the swarm overlay. Sufficient for npm/pip/docker push.
+  # Job containers use bridge networking — they get outbound internet access
+  # (needed to pull npm/pip packages and push to the registry) but are isolated
+  # from each other and the host.
   network: bridge
 
-  # Whitelist of host paths that workflow steps are allowed to bind-mount.
-  # The Docker socket is required for the build and deploy jobs.
+  # Paths the runner is allowed to bind-mount into job containers.
+  # The Docker socket is required for the build job (docker buildx).
   valid_volumes:
     - /var/run/docker.sock