ci: add Dockerfile for custom runner image

Based on ghcr.io/catthehacker/ubuntu:go-24.04 with stunnel4,
netcat-openbsd, dagger v0.20.8 and task v3.48.0 baked in so
nothing is downloaded during CI runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/Dockerfile

@@ -0,0 +1,15 @@
+FROM ghcr.io/catthehacker/ubuntu:go-24.04
+
+# Infrastructure tools required by CI workflows
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    stunnel4 \
+    netcat-openbsd \
+    && rm -rf /var/lib/apt/lists/*
+
+# Dagger CLI — pinned to match the engine version on the runner host
+RUN curl -fsSL https://dl.dagger.io/dagger/install.sh \
+    | DAGGER_VERSION=0.20.8 BIN_DIR=/usr/local/bin sh
+
+# Task runner
+RUN curl -fsSL https://taskfile.dev/install.sh \
+    | sh -s -- -b /usr/local/bin v3.48.0