fix(ci): match real runner labels + survivable Mac runner daemon

runs-on: ubuntu-24.04 (the label the existing Linux runner actually
advertises — ubuntu-latest queued forever). Mac runner: strip the
docker:// default labels generate-config seeds (they override the
host-mode registration labels and make the daemon demand a Docker
engine), and ship the service as a root LaunchDaemon — macOS Local
Network privacy silently blocks LAN dials from unbundled CLI binaries
in gui/user launchd domains ("no route to host"), system daemons are
exempt. Without sudo the script leaves an interim nohup daemon. CI
surface documented in CLAUDE.md + docs-site ci.md.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   rust:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: git.unom.io/unom/punktfunk-rust-ci:latest
     timeout-minutes: 90
@@ -60,7 +60,7 @@ jobs:
             || (echo "include/punktfunk_core.h is stale — commit the regenerated header" && exit 1)
 
   web:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: oven/bun:1
     timeout-minutes: 30
@@ -84,7 +84,7 @@ jobs:
         run: bun run lint
 
   docs-site:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     container:
       image: oven/bun:1
     timeout-minutes: 30

.gitea/workflows/docker.yml

@@ -24,7 +24,7 @@ env:
 
 jobs:
   build-push:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 45
     strategy:
       matrix: