forgejo-runner: match the live runner and pin the nix image

The role had drifted from what runs on asxpio-services: capacity 4,
a bridge network per workflow so service containers start, the Docker
socket automounted into jobs, and a nix-latest label backed by a
persistent nix-store volume.

That volume caused a CI outage on 2026-10-18. nixos/nix:latest moved on,
and since the image's /bin/sh and /etc/nix/nix.conf link into /nix/store,
the old volume left them dangling. Pin the image through
forgejo_runner_nix_version and name the volume after it, so a bump is
deliberate and always gets a store seeded from its own image.

Assisted-by: Claude:opus-5-5

ansible/roles/forgejo_runner/templates/docker-compose.yml.j2

@@ -1,13 +1,16 @@
+name: forgejo-runner
+
 services:
   forgejo-runner:
-    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     container_name: forgejo-runner
+    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
     restart: unless-stopped
-    user: "0:0"  # Run as root to access docker socket
-    command: forgejo-runner daemon
+    user: "0:0"  # Run as root to access Docker socket
+    command: forgejo-runner daemon --config /config.yaml
+    environment:
+      - CONFIG_FILE=/config.yaml
     volumes:
       - ./data:/data
       - ./config/config.yaml:/config.yaml
       - /var/run/docker.sock:/var/run/docker.sock
-    environment:
-      - CONFIG_FILE=/config.yaml
+    network_mode: host