refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

scripts/molecule_all.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Run all molecule scenarios on all supported OS platforms.
+# Used by `make molecule-all`. Sequential — CI uses parallel matrix instead.
+set -euo pipefail
+
+MOLECULE_BIN="$(realpath "${BIN:-.venv/bin}/molecule")"
+ROLE_DIR="$(cd "$(dirname "$0")/.." && pwd)/ansible/roles/gitea-runner"
+
+for p in \
+    ubuntu-2204:geerlingguy/docker-ubuntu2204-ansible:latest: \
+    ubuntu-2404:geerlingguy/docker-ubuntu2404-ansible:latest: \
+    debian-12:geerlingguy/docker-debian12-ansible:latest: \
+    archlinux:marcstraube/archlinux-ansible:latest:/usr/lib/systemd/systemd
+do
+    IFS=":" read -r name image command <<< "$p"
+    export MOLECULE_PLATFORM_NAME="$name" MOLECULE_PLATFORM_IMAGE="$image"
+    if [ -n "$command" ]; then
+        export MOLECULE_PLATFORM_COMMAND="$command"
+    else
+        unset MOLECULE_PLATFORM_COMMAND
+    fi
+    echo "=== Platform: $name ==="
+    for s in default multi-instance lifecycle template-content deregister update; do
+        echo "--- Scenario: $s on $name ---"
+        (
+            cd "$ROLE_DIR"
+            if [ "$s" = "default" ]; then
+                ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true ANSIBLE_INJECT_INVOCATION=1 "$MOLECULE_BIN" test
+            else
+                ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true ANSIBLE_INJECT_INVOCATION=1 "$MOLECULE_BIN" test -s "$s"
+            fi
+        )
+    done
+done