docs: runner relabeled to fedora (gitea-runner v3.5.0, site-wide); bump rpm-sources template to Fedora 44

docs/architecture.md

@@ -19,7 +19,7 @@ flowchart LR
     end
 
     subgraph runbox["runner VM (on the phyllome Cloudron host)"]
-        r1[act_runner daemon]
+        r1[gitea-runner daemon]
         host[HOST labels: run-on-host jobs<br>mock / livemedia-creator / pykickstart]
         img[CONTAINER labels:<br>docker://git.phyllo.me/devops/fedora-runner-image]
     end
@@ -72,9 +72,10 @@ flowchart LR
 
 - **Self-contained actions**: all `uses:` point at `git.phyllo.me/...` mirrors —
   no third-party action code, no github.com calls.
-- **Runner host**: dedicated VM on the phyllome Cloudron host; `act_runner`
-  runs as unprivileged `act_runner` system user; Docker access for container
-  jobs only.
+- **Runner host**: dedicated VM on the phyllome Cloudron host; `gitea-runner`
+  v3.5.0 runs as unprivileged `act_runner` system user; Docker access for container
+  jobs only. Registered site-wide with label `fedora` (runs-on: fedora); the VM
+  runs Fedora 44.
 - **Secrets**: CI secrets live in Gitea (repo/org) — never in the runner config.
   Registration token is UI-generated and consumed once.
 - **Read-only infra automation**: the `automation` repo's MCP servers scope

docs/server-phyllome-cloudron.md

@@ -50,14 +50,17 @@ documents what the factory depends on.
   - `devops/fedora-oci`, `devops/qemu-libvirt-oci-image` — builder images
   - `roots/fedora-iso-creation:42` — devcontainer referenced by test-actions
 - **Gitea Actions** is enabled on the product repos.
-- **Runners**: none registered yet → see `RUNBOOK.md`. Expected label: `fedora`.
+- **Runner**: one site-wide runner (`fedora-nuc`, id 56) on the dedicated runner
+  VM on this host, label `fedora` (Fedora 44). See `RUNBOOK.md` §1 for
+  registration/scope.
 
 ## Access model
 
 - `git.phyllo.me` user `lukas` (id 4, **not** Gitea admin) — used by the read and
   write API tokens.
 - Runner registration requires a **runner registration token** from the Gitea UI
-  (Settings → Actions → Runners) — admin/owner action, see RUNBOOK.
+  (**Site Administration → Actions → Runners** for site-wide) — admin/owner
+  action, see RUNBOOK.
 - Cloudron ownership is via an OIDC/owner account `superuser@phyllo.me`; API
   tokens (`tower-read`, `tower`, …) are created/deleted via the Cloudron UI
   (visible in the event log).