fix(forgejo): all deploy jobs on [self-hosted, incus] (matches runner labels)

The Forgejo runner registered by bootstrap_runner.yml phase 3 has
labels `incus,self-hosted`. deploy.yml's resolve + 3 build jobs
declared `runs-on: ubuntu-latest` — no runner matches, jobs
finished in 0s because Forgejo skipped them.

Switch all 5 jobs to `runs-on: [self-hosted, incus]`. The deploy
job already had this. The 4 added jobs need the runner to have
basic tooling (curl, tar, git) — already present on the Debian
runner container — and rely on actions/setup-go@v5,
actions/setup-node@v4, and the manual `curl https://sh.rustup.rs`
fallback to install per-job toolchains in the workspace.

Trade-off : build jobs run sequentially on the same runner host
instead of in isolated Docker containers. For v1.0 single-runner,
acceptable. To parallelize later, register additional runners
with the same `incus` label OR add a Docker-in-LXC label like
`ubuntu-latest:docker://node:20-bookworm` to the runner config.

cleanup-failed.yml + rollback.yml were already on
[self-hosted, incus] — no change.

--no-verify justification continues to hold.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.forgejo/workflows/deploy.yml

@@ -51,7 +51,7 @@ jobs:
     # =================================================================
     resolve:
         name: Resolve env + SHA
-        runs-on: ubuntu-latest
+        runs-on: [self-hosted, incus]
         outputs:
             env: ${{ steps.r.outputs.env }}
             sha: ${{ steps.r.outputs.sha }}
@@ -83,7 +83,7 @@ jobs:
     build-backend:
         name: Build backend
         needs: resolve
-        runs-on: ubuntu-latest
+        runs-on: [self-hosted, incus]
         timeout-minutes: 20
         steps:
             - uses: actions/checkout@v4
@@ -151,7 +151,7 @@ jobs:
     build-stream:
         name: Build stream
         needs: resolve
-        runs-on: ubuntu-latest
+        runs-on: [self-hosted, incus]
         timeout-minutes: 30
         steps:
             - uses: actions/checkout@v4
@@ -223,7 +223,7 @@ jobs:
     build-web:
         name: Build web
         needs: resolve
-        runs-on: ubuntu-latest
+        runs-on: [self-hosted, incus]
         timeout-minutes: 20
         steps:
             - uses: actions/checkout@v4