feat(runners): decoupled Pulumi stack for the fenced runner fleet (R5)

A separate, isolated Pulumi project (peer to bootstrap/provision/offsite-backup)
that provisions runner VM(s) on a libvirt host and registers Forgejo Actions
runners with a distinct `fenced` label — so ecosystem/untrusted jobs run OFF the
forge VM.

Decoupled ON PURPOSE: a @pulumi/libvirt provider dials the runner host on every
up/refresh, so keeping it in `bootstrap` would make the foundation undeployable/
unrefreshable whenever the host (crunchy01) is down or unreachable (the Terraform
coupling trap). As its own stack, bootstrap never imports it — foundation ops
never touch crunchy01, and this stack's health is independent. One-way dependency:
it mints a runner token FROM the forge, i.e. runs after the foundation stands.

Codifies what was built + hardened by hand this session (runners/README.md):
Ubuntu VM on the LAN bridge (docker + qemu-guest-agent via cloud-init), the
kube-router-proof FORWARD timer, and runner registration. Typechecked; the live
`pulumi up` cutover from the hand-built VM is the remaining validation step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

runners/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@olsitec/foundation-runners",
+  "private": true,
+  "version": "0.0.0",
+  "main": "index.ts",
+  "description": "Isolated stack: the fenced Forgejo Actions runner fleet on libvirt hosts.",
+  "dependencies": {
+    "@pulumi/pulumi": "^3.138.0",
+    "@pulumi/libvirt": "^0.5.3",
+    "@pulumi/command": "^1.1.3",
+    "js-yaml": "^4.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^18",
+    "@types/js-yaml": "^4.0.9",
+    "typescript": "^5.0.0"
+  }
+}