refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/ci.yml

@@ -36,22 +36,32 @@ jobs:
       - uses: actions/checkout@v4
       - name: Set up environment
         run: make setup
-      - name: Discover assigned scenarios
+      - name: Discover assigned test pairs
         run: |
           . .venv/bin/activate
-          SCENARIOS=$(python3 scripts/distribute_molecule.py --runner-index ${{ matrix.runner-index }} --max-runners 3)
-          echo "Assigned scenarios: $SCENARIOS"
-          echo "SCENARIOS=$SCENARIOS" >> $GITHUB_ENV
+          PAIRS=$(python3 scripts/distribute_molecule.py --runner-index ${{ matrix.runner-index }} --max-runners 3)
+          echo "Assigned pairs: $PAIRS"
+          echo "TEST_PAIRS=$PAIRS" >> $GITHUB_ENV
       - name: Run molecule tests
         run: |
           . .venv/bin/activate
           export DOCKER_HOST="unix:///run/user/$(id -u)/docker.sock"
           export ANSIBLE_INJECT_INVOCATION=1
           cd ansible/roles/gitea-runner
-          for s in $SCENARIOS; do
-            if [ "$s" = "default" ]; then
+          for pair in $TEST_PAIRS; do
+            IFS='|' read -r scenario platform_name platform_image platform_command <<< "$pair"
+            export MOLECULE_PLATFORM_NAME="$platform_name"
+            export MOLECULE_PLATFORM_IMAGE="$platform_image"
+            if [ -n "$platform_command" ]; then
+              export MOLECULE_PLATFORM_COMMAND="$platform_command"
+            else
+              unset MOLECULE_PLATFORM_COMMAND
+            fi
+            echo "::group::Molecule: $scenario on $platform_name"
+            if [ "$scenario" = "default" ]; then
               ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true molecule test
             else
-              ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true molecule test -s "$s"
+              ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true molecule test -s "$scenario"
             fi
+            echo "::endgroup::"
           done