ci: migrate to ci-runners.md (container.image consumption)

Adopts the FabledRulebook ci-runners.md policy: workflows select
toolchains via container.image, not via runs-on labels. `runs-on`
stays as the scheduling handle only.

Workflows updated:
- test-go.yml: ci-go:1.26 on both `test` and `integration` jobs.
- test-web.yml: ci-go:1.26 (bundles Node + npm); the
  actions/setup-node@v4 step is removed.
- flutter.yml: ci-flutter:3.44 (Flutter 3.44 + Android + Java 25).
- release.yml: ci-go:1.26 (ships docker CLI + buildx).

Side effect: this unblocks the Go server deps bump (commit 6a62120)
which auto-bumped go.mod to `go 1.25.0` via x/crypto v0.51.0's
minimum — ci-go:1.26 satisfies it with headroom.

Adds ci-requirements.md at repo root per the ci-runners.md
"every project ships a requirements sheet" rule. Documents:
runtime images consumed, image deps used per workflow, per-job
installs (none), and a Notes section covering the integration
docker-socket dependency, the toolchain pin rationale, and the
in-app-update channel polling.

Tracked in local task #70.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/flutter.yml

@@ -31,10 +31,13 @@ on:
 
 jobs:
   analyze-test-build:
-    # flutter-ci runner image (CI-Runner/CI-flutter/Dockerfile) bakes in
-    # Flutter SDK + Android cmdline-tools + platform-34 + build-tools 34.0.0
-    # + JDK 17 + a non-root `runner` user. No setup-action ceremony needed.
+    # Toolchain selected via container.image per ci-runners.md
+    # (label = scheduling handle, image = environment). The ci-flutter
+    # image ships Flutter SDK + Android cmdline-tools/platform/build-tools
+    # + Java 25. See ci-requirements.md.
     runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-flutter:3.44
 
     defaults:
       run:

.forgejo/workflows/release.yml

@@ -23,6 +23,8 @@ on:
 jobs:
   release:
     runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
 
     env:
       IMAGE: git.fabledsword.com/bvandeusen/minstrel

.forgejo/workflows/test-go.yml

@@ -44,6 +44,8 @@ on:
 jobs:
   test:
     runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
 
     steps:
       - name: Checkout
@@ -65,6 +67,8 @@ jobs:
 
   integration:
     runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
     services:
       postgres:
         image: postgres:16-alpine

.forgejo/workflows/test-web.yml

@@ -19,6 +19,8 @@ on:
 jobs:
   test:
     runs-on: go-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-go:1.26
 
     defaults:
       run:
@@ -28,18 +30,6 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup Node
-        # `cache: 'npm'` removed — the Forgejo Actions cache server at
-        # 172.18.0.27:41161 isn't reachable from this runner's container,
-        # so setup-node spent 4m41s burning the npm cache restore on
-        # ETIMEDOUT before failing open. npm ci still works deterministically
-        # from package-lock.json; just re-fetches from the registry on each
-        # run. Restore the cache option once the runner-host network reaches
-        # the cache server.
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
       - name: Install deps
         run: npm ci