refactor: rootless Docker, fix auto-merge, molecule platform matrix

Three major improvements:

1. Rootless Docker refactor: Removes docker/binary modes, unifies to
   rootless Docker with per-runner system users. Each runner gets its
   own rootless Docker daemon, systemd user service, and isolated
   environment. Simplifies CLI (removes --mode option), Ansible role
   (single code path), and molecule scenarios (removes binary scenario).

2. Auto-merge fix: Fixes status check context mismatch in branch
   protection (was requiring "lint", "unit-tests", "molecule-tests" but
   actual contexts are "CI / quality", "CI / molecule-tests*"). Adds
   retry/wait logic to auto_merge.py that polls commit statuses for up
   to 15 minutes before attempting merge, eliminating the chicken-and-egg
   problem where auto-merge would fail because CI hadn't completed yet.

3. Molecule platform matrix: Adds OS platform matrix to CI — all 6
   scenarios now run on all 4 supported OSes (ubuntu-2204, ubuntu-2404,
   debian-12, archlinux) = 24 test pairs distributed across 3 parallel
   runners. Updates distribute_molecule.py to distribute (scenario,
   platform) pairs. Updates Makefile with molecule-all target for
   local multi-platform testing.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/integration/test_multi_instance.py

@@ -26,15 +26,13 @@ class TestMultiInstanceCLI:
         assert result.exit_code == 0
 
         # Install instance B
-        result = runner.invoke(cli, ["install", "host1", "--user", "ubuntu", "--name", "runner-b", "--mode", "binary"])
+        result = runner.invoke(cli, ["install", "host1", "--user", "ubuntu", "--name", "runner-b"])
         assert result.exit_code == 0
 
         assert mock_manager.install.call_count == 2
         calls = mock_manager.install.call_args_list
         assert calls[0].kwargs["name"] == "runner-a"
-        assert calls[0].kwargs["mode"] == "docker"
         assert calls[1].kwargs["name"] == "runner-b"
-        assert calls[1].kwargs["mode"] == "binary"
 
     @patch("gitea_runner_manager.cli.RunnerManager")
     def test_start_stop_one_instance(self, mock_manager_class: MagicMock) -> None:
@@ -44,12 +42,16 @@ class TestMultiInstanceCLI:
 
         runner = CliRunner()
 
-        result = runner.invoke(cli, ["start", "host1", "--user", "ubuntu", "--name", "runner-a"])
+        result = runner.invoke(
+            cli, ["start", "runner-a", "--host", "host1", "--user", "ubuntu", "--no-ask-become-pass"]
+        )
         assert result.exit_code == 0
         mock_manager.start.assert_called_once_with(
-            host="host1", user="ubuntu", name="runner-a", mode="docker", ask_become_pass=False
+            host="host1", user="ubuntu", name="runner-a", key=None, ask_become_pass=False
         )
 
-        result = runner.invoke(cli, ["stop", "host1", "--user", "ubuntu", "--name", "runner-b"])
+        result = runner.invoke(cli, ["stop", "runner-b", "--host", "host1", "--user", "ubuntu", "--no-ask-become-pass"])
         assert result.exit_code == 0
-        mock_manager.stop.assert_called_once_with(host="host1", user="ubuntu", name="runner-b", ask_become_pass=False)
+        mock_manager.stop.assert_called_once_with(
+            host="host1", user="ubuntu", name="runner-b", key=None, ask_become_pass=False
+        )