feat(runner): dedicated rust-build runner instance for LinuxRust2404

`runs-on: rust-build` needs a second act_runner instance, not another label on
the existing one: act_runner resolves a single runner.envs block per process
and never tells the workflow which label picked the job. A label can select a
template only by selecting a runner whose envs name that template. Registered
as ci-linux-rust (id 3), online, announcing rust-build.

- deploy/runner-rust-config.yaml: label rust-build:host only, envs pointing at
  LinuxRust2404 + BaseClean-LinuxRust, its own cache dir (two processes must
  not share one actcache database), capacity 1 on top of the main runner's 2.
  runner.file is absolute: act_runner resolves a relative `file:` against the
  process CWD, so registering from elsewhere drops the registration state --
  which holds the runner token -- wherever it was invoked, and the daemon then
  fails with "registration file not found".
- scripts/install-rust-runner.sh: idempotent, --dry-run, refuses to touch the
  main runner directory, requires the template to exist first. Takes
  --token-file rather than --token so the secret stays out of the process
  argument list; the dry-run echo redacts it.
- tools/gitea-runner-token.py: mints a registration token from the stored
  GiteaPAT and writes it to a 0600 file. Neither secret is ever printed. Sets
  an explicit User-Agent because Cloudflare rejects urllib's default with
  error 1010.
- tools/gitea-runner-list.py: --label NAME exits non-zero unless an ONLINE
  runner announces it. A runs-on value no runner advertises leaves jobs
  unschedulable with no error anywhere, which is exactly the failure the
  consumer repo warned about.

deploy/systemd/act-runner-rust.service

@@ -0,0 +1,31 @@
+[Unit]
+# Second act_runner instance, dedicated to the Rust build template.
+#
+# Why a second instance instead of one more label on the existing runner:
+# act_runner has a single `runner.envs` block per process, and it does not
+# expose the job's runs-on label to the workflow (no RUNNER_LABELS variable).
+# So a label can only select a *template* if it selects a *runner* whose envs
+# name that template. One label per runner instance is the only wiring that
+# actually routes.
+#
+# Provisioned by scripts/install-rust-runner.sh.
+Description=Gitea Act Runner (rust-build)
+After=network-online.target vmware-host.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=ci-runner
+WorkingDirectory=/var/lib/ci/runner-rust
+Environment="PYTHONIOENCODING=utf-8"
+Environment="CI_ROOT=/var/lib/ci"
+Environment="CI_TEMPLATES=/var/lib/ci/templates"
+Environment="CI_BUILD_VMS=/var/lib/ci/build-vms"
+Environment="CI_ARTIFACTS=/var/lib/ci/artifacts"
+Environment="CI_KEYS=/etc/ci/keys"
+ExecStart=/opt/ci/act_runner/act_runner daemon --config /var/lib/ci/runner-rust/config.yaml
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target