🐛 Fix act_runner cache/token config and Dockerfile OCI labels 🐛

Verified via AI.md PART 8 syntax gate (bash -n across all rootfs scripts),
hadolint on Dockerfile, script-lint agent on the two shell scripts, and
YAML validation on both config files — all pass.

- Dockerfile: org.opencontainers.image.url corrected from the stale
  https://docker.io/casjaysdevdocker/forgejo registry-pull form to the
  browsable https://hub.docker.com/r/casjaysdevdocker/forgejo page, per
  AI.md PART 0 rule 5.
- Dockerfile: final-stage ENV HOSTNAME prefix corrected from
  casjaysdev-${IMAGE_NAME} to casjaysdevdocker-${IMAGE_NAME}, matching
  the build stage and AI.md PART 2's HOSTNAME convention.
- rootfs/tmp/etc/act_runner/cache_server.yaml: cache.external_secret
  renamed to cache.secret — act_runner cache-server's config loader only
  recognizes secret, not external_secret.
- rootfs/tmp/etc/act_runner/default_config.yaml: same external_secret ->
  secret rename in the cache: block (runner-side config).
- rootfs/usr/local/bin/start-runners: same external_secret -> secret
  rename in the generated runners-cache.yaml heredoc.
- rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh: runner
  registration token extraction regex widened from [A-Za-z0-9]{20,} to
  [A-Za-z0-9_-]{20,} so tokens containing hyphens/underscores are no
  longer truncated.
- TODO.AI.md: logged the two Dockerfile compliance fixes above, and
  logged (not fixed — out of scope, template-owned file) a stale
  __copy_templates/DEFAULT_TEMPLATE_DIR reference found in
  functions/entrypoint.sh while running the dead-reference gate.
- .claude/scheduled_tasks.lock: session lock rotation (automatic, not a
  deliberate change).

Dockerfile

@@ -207,7 +207,7 @@ LABEL org.opencontainers.image.description="Containerized version of ${IMAGE_NAM
 LABEL org.opencontainers.image.created="${BUILD_DATE}"
 LABEL org.opencontainers.image.version="${BUILD_VERSION}"
 LABEL org.opencontainers.image.revision="${GIT_COMMIT}"
-LABEL org.opencontainers.image.url="https://docker.io/casjaysdevdocker/forgejo"
+LABEL org.opencontainers.image.url="https://hub.docker.com/r/casjaysdevdocker/forgejo"
 LABEL org.opencontainers.image.source="https://github.com/casjaysdevdocker/forgejo"
 LABEL org.opencontainers.image.documentation="https://github.com/casjaysdevdocker/forgejo"
 LABEL org.opencontainers.image.vcs-type="Git"
@@ -224,7 +224,7 @@ ENV TERM="xterm-256color"
 ENV PORT="${SERVICE_PORT}"
 ENV ENV_PORTS="${ENV_PORTS}"
 ENV CONTAINER_NAME="${IMAGE_NAME}"
-ENV HOSTNAME="casjaysdev-${IMAGE_NAME}"
+ENV HOSTNAME="casjaysdevdocker-${IMAGE_NAME}"
 ENV PHP_SERVER="${PHP_SERVER}"
 ENV NODE_VERSION="${NODE_VERSION}"
 ENV NODE_MANAGER="${NODE_MANAGER}"
@@ -242,4 +242,3 @@ STOPSIGNAL SIGRTMIN+3
 
 ENTRYPOINT [ "tini", "-p", "SIGTERM","--", "/usr/local/bin/entrypoint.sh" ]
 HEALTHCHECK --start-period=10m --interval=5m --timeout=15s CMD [ "/usr/local/bin/entrypoint.sh", "healthcheck" ]
-