refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea-runner/molecule/multi-instance/converge.yml

@@ -6,7 +6,6 @@
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-a"
-    runner_mode: "binary"
     skip_runner_registration: true
   roles:
     - role: gitea-runner
@@ -18,7 +17,6 @@
     gitea_url: "http://localhost:3000"
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-b"
-    runner_mode: "binary"
     skip_runner_registration: true
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/multi-instance/verify.yml

@@ -6,24 +6,32 @@
     - name: Load role defaults
       ansible.builtin.include_vars:
         dir: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/defaults"
-    - name: Override runner mode for multi-instance scenario
-      ansible.builtin.set_fact:
-        runner_mode: "binary"
   tasks:
-    - name: Check systemd template unit exists
+    - name: Check first runner user exists
       ansible.builtin.stat:
-        path: "/etc/systemd/system/gitea-runner-{{ runner_mode | default('docker') }}@.service"
-      register: template_stat
+        path: "{{ gitea_runner_base_home }}/grm-molecule-runner-a"
+      register: home_a_stat
 
-    - name: Assert template unit exists
+    - name: Assert first runner user home exists
       ansible.builtin.assert:
         that:
-          - template_stat.stat.exists
-        fail_msg: "Systemd template unit is missing"
+          - home_a_stat.stat.exists
+        fail_msg: "First runner user home is missing"
+
+    - name: Check second runner user exists
+      ansible.builtin.stat:
+        path: "{{ gitea_runner_base_home }}/grm-molecule-runner-b"
+      register: home_b_stat
+
+    - name: Assert second runner user home exists
+      ansible.builtin.assert:
+        that:
+          - home_b_stat.stat.exists
+        fail_msg: "Second runner user home is missing"
 
     - name: Check first instance data directory exists
       ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/molecule-runner-a"
+        path: "{{ gitea_runner_base_data_dir }}/molecule-runner-a"
       register: data_a_stat
 
     - name: Assert first instance data directory exists
@@ -34,7 +42,7 @@
 
     - name: Check second instance data directory exists
       ansible.builtin.stat:
-        path: "/var/lib/gitea-runner/molecule-runner-b"
+        path: "{{ gitea_runner_base_data_dir }}/molecule-runner-b"
       register: data_b_stat
 
     - name: Assert second instance data directory exists
@@ -45,7 +53,7 @@
 
     - name: Check first instance config exists
       ansible.builtin.stat:
-        path: "/etc/gitea-runner/molecule-runner-a/config.yaml"
+        path: "{{ gitea_runner_base_config_dir }}/molecule-runner-a/config.yaml"
       register: config_a_stat
 
     - name: Assert first instance config exists
@@ -56,7 +64,7 @@
 
     - name: Check second instance config exists
       ansible.builtin.stat:
-        path: "/etc/gitea-runner/molecule-runner-b/config.yaml"
+        path: "{{ gitea_runner_base_config_dir }}/molecule-runner-b/config.yaml"
       register: config_b_stat
 
     - name: Assert second instance config exists