ansible: run the another-im/interop runner on asxpio-services

The interop project kept a cx23 (claude-test-interop-runner, about
EUR 6/month with its IPv4) only to run its Forgejo runner. Run it here
instead, with the same registration (UUID + token, token in the vault)
and the same three labels, pinned.

Its PR checks are untrusted, so unlike our own runner its jobs get
neither the Docker socket nor host volumes. nix-host, which on the old
host used the host's Nix store as a cache, is a throwaway container for
now; a second, trusted-only registration can bring the cache back.

Rollback: remove the role from site.yaml (or stop the container) and
start the old runner VM again.

Assisted-by: Claude:opus-5-5

ansible/roles/forgejo_runner_interop/tasks/main.yaml

@@ -0,0 +1,13 @@
+---
+- name: Deploy the another-im/interop runner
+  ansible.builtin.include_role:
+    name: docker_service
+  vars:
+    service_name: forgejo-runner-interop
+    service_base_path: "{{ services_base_path }}/forgejo-runner-interop"
+    service_directories:
+      - { path: data }
+    service_templates:
+      - { src: docker-compose.yml.j2, dest: docker-compose.yml }
+      - { src: config.yaml.j2, dest: config.yaml, mode: "0600" }
+    health_check_enabled: false

ansible/roles/forgejo_runner_interop/templates/config.yaml.j2

@@ -0,0 +1,40 @@
+# Managed by Ansible (role forgejo_runner_interop).
+log:
+  level: info
+  job_level: info
+
+runner:
+  capacity: {{ interop_runner_capacity }}
+  # Builds wait up to 4 h on their builder VM
+  timeout: 5h
+  shutdown_timeout: 5h
+  fetch_interval: 5s
+  envs:
+    # The old host had flakes on in nix.conf; jobs here get it this way
+    NIX_CONFIG: |
+      experimental-features = nix-command flakes
+      build-users-group =
+      sandbox = false
+  labels:
+    # PR checks: throwaway container
+    - "nix:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
+    - "docker:docker://node:22.23.5-bookworm"
+    # Trusted workflows (servers, build-anotherim). On the old host this ran
+    # on the host with its Nix store as cache; here a throwaway container
+    # until a second, trusted-only registration gets a persistent store.
+    - "nix-host:docker://nixos/nix:{{ forgejo_runner_nix_version }}"
+
+container:
+  network: bridge
+  privileged: false
+  # PR checks run here: no Docker socket and no host volumes in jobs
+  docker_host: "-"
+  valid_volumes: []
+  force_pull: false
+
+server:
+  connections:
+    interop:
+      url: https://dev.another.im/
+      uuid: {{ interop_runner_uuid }}
+      token: {{ interop_runner_token }}

ansible/roles/forgejo_runner_interop/templates/docker-compose.yml.j2

@@ -0,0 +1,12 @@
+# Managed by Ansible (role forgejo_runner_interop).
+services:
+  forgejo-runner-interop:
+    container_name: forgejo-runner-interop
+    image: code.forgejo.org/forgejo/runner:{{ forgejo_runner_version }}
+    restart: unless-stopped
+    user: "0:0"  # the runner itself talks to Docker; its jobs do not
+    command: forgejo-runner daemon --config /config.yaml
+    volumes:
+      - ./data:/data
+      - ./config.yaml:/config.yaml:ro
+      - /var/run/docker.sock:/var/run/docker.sock