ci: migrate to ci-runners.md (container.image consumption)

Adopts the FabledRulebook ci-runners.md policy: workflows select
toolchains via container.image, not via runs-on labels. `runs-on`
stays as the scheduling handle only.

Workflows updated:
- test-go.yml: ci-go:1.26 on both `test` and `integration` jobs.
- test-web.yml: ci-go:1.26 (bundles Node + npm); the
  actions/setup-node@v4 step is removed.
- flutter.yml: ci-flutter:3.44 (Flutter 3.44 + Android + Java 25).
- release.yml: ci-go:1.26 (ships docker CLI + buildx).

Side effect: this unblocks the Go server deps bump (commit 6a62120)
which auto-bumped go.mod to `go 1.25.0` via x/crypto v0.51.0's
minimum — ci-go:1.26 satisfies it with headroom.

Adds ci-requirements.md at repo root per the ci-runners.md
"every project ships a requirements sheet" rule. Documents:
runtime images consumed, image deps used per workflow, per-job
installs (none), and a Notes section covering the integration
docker-socket dependency, the toolchain pin rationale, and the
in-app-update channel polling.

Tracked in local task #70.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/flutter.yml

@@ -31,10 +31,13 @@ on:
 
 jobs:
   analyze-test-build:
-    # flutter-ci runner image (CI-Runner/CI-flutter/Dockerfile) bakes in
-    # Flutter SDK + Android cmdline-tools + platform-34 + build-tools 34.0.0
-    # + JDK 17 + a non-root `runner` user. No setup-action ceremony needed.
+    # Toolchain selected via container.image per ci-runners.md
+    # (label = scheduling handle, image = environment). The ci-flutter
+    # image ships Flutter SDK + Android cmdline-tools/platform/build-tools
+    # + Java 25. See ci-requirements.md.
     runs-on: flutter-ci
+    container:
+      image: git.fabledsword.com/bvandeusen/ci-flutter:3.44
 
     defaults:
       run: