Migrate Compose CI runners to official gitea/runner image

Upgrade both gitea-runner and pi-review-runner on 5.9.138.8 in /opt/kaukus-ci/docker-compose.yml from gitea/act_runner:nightly to a current stable gitea/runner version. Inspect image/config compatibility first; preserve registration state, labels, Pi auth mount, host Docker mode, and existing low-priority CPU policy. Back up configuration and registration files without exposing secrets; validate configuration and registration after recreation, and run a small local job if supported. Do not restart production Teams/video containers. User authorized CI interruption during prior CPU migration. Acceptance: both runners on verified new image, existing registrations/labels preserved, connected to Gitea, CPU settings unchanged, rollback assets available; report limits of local versus real CI testing. Verified outcome: both Compose services now use gitea/runner:5.2.0 (pulled digest sha256:f4db24cc5f682483ffd01b8de6a6c6d15e6fd9320a0ce27fd18d4398db421eae), confirmed binary v5.2.0. Existing YAML validated with the new binary before rollout; Compose validation passed. Backups including protected registration credentials are under /opt/kaukus-ci/before-runner-upgrade-20261022T123338Z; old image retained locally. Both daemons declare successfully with Gitea. IDs 51/45, UUIDs, credentials, names, addresses, labels unchanged against backups. Effective runner and local job cgroups retain weight=1/unlimited in system-ci.slice. Local shell smoke workflows passed using both new runner binaries and saved container options; Pi job auth volume mount confirmed without inspecting credentials. These tests used exec, not server-dispatched CI, and omit checkout/repository integration; harmless missing-git-repository warnings were present. Production Teams/video original start times unchanged. Existing CPU-priority scope limitation for workflow-specific options/service or extra Docker containers remains unchanged.