🐛 Fix act_runner cache/token config and Dockerfile OCI labels 🐛

Verified via AI.md PART 8 syntax gate (bash -n across all rootfs scripts),
hadolint on Dockerfile, script-lint agent on the two shell scripts, and
YAML validation on both config files — all pass.

- Dockerfile: org.opencontainers.image.url corrected from the stale
  https://docker.io/casjaysdevdocker/forgejo registry-pull form to the
  browsable https://hub.docker.com/r/casjaysdevdocker/forgejo page, per
  AI.md PART 0 rule 5.
- Dockerfile: final-stage ENV HOSTNAME prefix corrected from
  casjaysdev-${IMAGE_NAME} to casjaysdevdocker-${IMAGE_NAME}, matching
  the build stage and AI.md PART 2's HOSTNAME convention.
- rootfs/tmp/etc/act_runner/cache_server.yaml: cache.external_secret
  renamed to cache.secret — act_runner cache-server's config loader only
  recognizes secret, not external_secret.
- rootfs/tmp/etc/act_runner/default_config.yaml: same external_secret ->
  secret rename in the cache: block (runner-side config).
- rootfs/usr/local/bin/start-runners: same external_secret -> secret
  rename in the generated runners-cache.yaml heredoc.
- rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh: runner
  registration token extraction regex widened from [A-Za-z0-9]{20,} to
  [A-Za-z0-9_-]{20,} so tokens containing hyphens/underscores are no
  longer truncated.
- TODO.AI.md: logged the two Dockerfile compliance fixes above, and
  logged (not fixed — out of scope, template-owned file) a stale
  __copy_templates/DEFAULT_TEMPLATE_DIR reference found in
  functions/entrypoint.sh while running the dead-reference gate.
- .claude/scheduled_tasks.lock: session lock rotation (automatic, not a
  deliberate change).

rootfs/tmp/etc/act_runner/cache_server.yaml

@@ -6,4 +6,4 @@ cache:
   dir: 'REPLACE_RUNNER_CACHE_DIR'
   host: '0.0.0.0'
   port: REPLACE_RUNNER_CACHE_PORT
-  external_secret: 'REPLACE_RUNNER_CACHE_SECRET'
+  secret: 'REPLACE_RUNNER_CACHE_SECRET'

rootfs/tmp/etc/act_runner/default_config.yaml

@@ -68,4 +68,4 @@ container:
 cache:
   enabled: true
   external_server: 'http://REPLACE_RUNNER_CACHE_HOST:REPLACE_RUNNER_CACHE_PORT/'
-  external_secret: 'REPLACE_RUNNER_CACHE_SECRET'
+  secret: 'REPLACE_RUNNER_CACHE_SECRET'