feat(runner): dedicated rust-build runner instance for LinuxRust2404

`runs-on: rust-build` needs a second act_runner instance, not another label on
the existing one: act_runner resolves a single runner.envs block per process
and never tells the workflow which label picked the job. A label can select a
template only by selecting a runner whose envs name that template. Registered
as ci-linux-rust (id 3), online, announcing rust-build.

- deploy/runner-rust-config.yaml: label rust-build:host only, envs pointing at
  LinuxRust2404 + BaseClean-LinuxRust, its own cache dir (two processes must
  not share one actcache database), capacity 1 on top of the main runner's 2.
  runner.file is absolute: act_runner resolves a relative `file:` against the
  process CWD, so registering from elsewhere drops the registration state --
  which holds the runner token -- wherever it was invoked, and the daemon then
  fails with "registration file not found".
- scripts/install-rust-runner.sh: idempotent, --dry-run, refuses to touch the
  main runner directory, requires the template to exist first. Takes
  --token-file rather than --token so the secret stays out of the process
  argument list; the dry-run echo redacts it.
- tools/gitea-runner-token.py: mints a registration token from the stored
  GiteaPAT and writes it to a 0600 file. Neither secret is ever printed. Sets
  an explicit User-Agent because Cloudflare rejects urllib's default with
  error 1010.
- tools/gitea-runner-list.py: --label NAME exits non-zero unless an ONLINE
  runner announces it. A runs-on value no runner advertises leaves jobs
  unschedulable with no error anywhere, which is exactly the failure the
  consumer repo warned about.

deploy/runner-rust-config.yaml

@@ -0,0 +1,84 @@
+# act_runner configuration — rust-build instance (LinuxRust2404 template).
+#
+# Installed to /var/lib/ci/runner-rust/config.yaml by
+# scripts/install-rust-runner.sh. Keep this file and the live one in sync.
+#
+# This instance exists only to give `runs-on: rust-build` its own template.
+# act_runner resolves one `runner.envs` block per process and never tells the
+# workflow which label picked the job, so routing a label to a template means
+# routing it to a runner. Everything else (host paths, capacity budget) mirrors
+# the main runner at /var/lib/ci/runner/config.yaml.
+
+log:
+  level: info
+
+runner:
+  # Absolute on purpose: act_runner resolves a relative `file` against the
+  # process CWD, so `register` run from anywhere but this directory would drop
+  # the registration state (which holds the runner token) wherever it happened
+  # to be invoked, and the daemon would then start with "registration file not
+  # found".
+  file: /var/lib/ci/runner-rust/.runner
+  # Concurrent jobs. This is ON TOP of the main runner's capacity — both
+  # instances clone VMs onto the same host. Keep main.capacity +
+  # rust.capacity within the host RAM budget (~8 GB per build VM).
+  capacity: 1
+  envs:
+    CI_PYTHON_LAUNCHER: /opt/ci/venv/bin/python
+    # The Rust template. `guest-os: 'Linux'` in the workflow resolves to this.
+    GITEA_CI_LINUX_TEMPLATE_PATH: /var/lib/ci/templates/LinuxRust2404/LinuxRust2404.vmx
+    # Read by the local-ci-build composite action; without it the action falls
+    # back to 'BaseClean-Linux', which does not exist on this template.
+    GITEA_CI_LINUX_SNAPSHOT_NAME: BaseClean-LinuxRust
+    # Windows template kept out on purpose: this runner announces no Windows
+    # label, so a Windows job can never be scheduled here.
+  env_file: .env
+  timeout: 3h
+  shutdown_timeout: 0s
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  fetch_interval_max: 5s
+  workdir_cleanup_age: 24h
+  idle_cleanup_interval: 10m
+  log_report_interval: 5s
+  log_report_max_latency: 3s
+  log_report_batch_size: 100
+  state_report_interval: 5s
+  github_mirror: ''
+  # Exactly one label. Adding linux-build here would make this instance
+  # eligible for generic Linux jobs and hand them the Rust template.
+  labels:
+    - "rust-build:host"
+  allocate_pty: false
+
+cache:
+  # Separate cache dir from the main runner: two processes must not share one
+  # actcache database.
+  enabled: true
+  dir: "/var/lib/ci/runner-rust/cache"
+  host: ""
+  port: 0
+  external_server: ""
+  external_secret: ""
+
+container:
+  # All builds run in VMware VMs, never containers.
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: []
+  docker_host: "-"
+  force_pull: false
+  force_rebuild: false
+  require_docker: false
+  docker_timeout: 0s
+  bind_workdir: false
+
+host:
+  workdir_parent:
+
+metrics:
+  enabled: false
+  addr: "127.0.0.1:9102"

deploy/systemd/act-runner-rust.service

@@ -0,0 +1,31 @@
+[Unit]
+# Second act_runner instance, dedicated to the Rust build template.
+#
+# Why a second instance instead of one more label on the existing runner:
+# act_runner has a single `runner.envs` block per process, and it does not
+# expose the job's runs-on label to the workflow (no RUNNER_LABELS variable).
+# So a label can only select a *template* if it selects a *runner* whose envs
+# name that template. One label per runner instance is the only wiring that
+# actually routes.
+#
+# Provisioned by scripts/install-rust-runner.sh.
+Description=Gitea Act Runner (rust-build)
+After=network-online.target vmware-host.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ci-runner
+WorkingDirectory=/var/lib/ci/runner-rust
+Environment="PYTHONIOENCODING=utf-8"
+Environment="CI_ROOT=/var/lib/ci"
+Environment="CI_TEMPLATES=/var/lib/ci/templates"
+Environment="CI_BUILD_VMS=/var/lib/ci/build-vms"
+Environment="CI_ARTIFACTS=/var/lib/ci/artifacts"
+Environment="CI_KEYS=/etc/ci/keys"
+ExecStart=/opt/ci/act_runner/act_runner daemon --config /var/lib/ci/runner-rust/config.yaml
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target