act runner image

Gitea / Forgejo Actions runner image based on runner-images:ubuntu-latest with the pinned, checksum-verified SOPS build installed, plus rsync from apt.

Built and pushed to git.studiovita.li/studio/actions:ubuntu-latest by the build workflow on push to main, weekly on a schedule (Sunday 04:00 cron), and on manual dispatch. The base image is pinned by digest so Renovate opens a PR whenever runner-images:ubuntu-latest changes; update SOPS_VERSION in Dockerfile to bump SOPS (both tracked in renovate.json).