🐛 Fix act_runner cache/token config and Dockerfile OCI labels 🐛

Verified via AI.md PART 8 syntax gate (bash -n across all rootfs scripts),
hadolint on Dockerfile, script-lint agent on the two shell scripts, and
YAML validation on both config files — all pass.

- Dockerfile: org.opencontainers.image.url corrected from the stale
  https://docker.io/casjaysdevdocker/forgejo registry-pull form to the
  browsable https://hub.docker.com/r/casjaysdevdocker/forgejo page, per
  AI.md PART 0 rule 5.
- Dockerfile: final-stage ENV HOSTNAME prefix corrected from
  casjaysdev-${IMAGE_NAME} to casjaysdevdocker-${IMAGE_NAME}, matching
  the build stage and AI.md PART 2's HOSTNAME convention.
- rootfs/tmp/etc/act_runner/cache_server.yaml: cache.external_secret
  renamed to cache.secret — act_runner cache-server's config loader only
  recognizes secret, not external_secret.
- rootfs/tmp/etc/act_runner/default_config.yaml: same external_secret ->
  secret rename in the cache: block (runner-side config).
- rootfs/usr/local/bin/start-runners: same external_secret -> secret
  rename in the generated runners-cache.yaml heredoc.
- rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh: runner
  registration token extraction regex widened from [A-Za-z0-9]{20,} to
  [A-Za-z0-9_-]{20,} so tokens containing hyphens/underscores are no
  longer truncated.
- TODO.AI.md: logged the two Dockerfile compliance fixes above, and
  logged (not fixed — out of scope, template-owned file) a stale
  __copy_templates/DEFAULT_TEMPLATE_DIR reference found in
  functions/entrypoint.sh while running the dead-reference gate.
- .claude/scheduled_tasks.lock: session lock rotation (automatic, not a
  deliberate change).

rootfs/usr/local/bin/start-runners

@@ -109,7 +109,7 @@ if [ -n "$RUNNER_CACHE_HOST" ] && [ -n "$RUNNER_CACHE_PORT" ] && [ -n "$RUNNER_C
 cache:
   enabled: true
   external_server: 'http://${RUNNER_CACHE_HOST}:${RUNNER_CACHE_PORT}/'
-  external_secret: '${RUNNER_CACHE_SECRET}'
+  secret: '${RUNNER_CACHE_SECRET}'
 EOF
 fi
 # - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh

@@ -143,7 +143,7 @@ __gen_auth_token() {
 			auth_token="$( gosu $user $forgejo_bin --config "$conf_file" \
 				--work-path /data/forgejo --custom-path /config/forgejo/custom \
 				actions generate-runner-token 2>/dev/null | \
-				grep -oE -- '[A-Za-z0-9]{20,}' | tail -n1 )"
+				grep -oE -- '[A-Za-z0-9_-]{20,}' | tail -n1 )"
 		fi
 	fi
 	if [ -n "$auth_token" ]; then