feat(runner): add nself runner provision/verify for CI runner hosts (G-012)

[acamarata]

Summary

Closes G-012. CI runner hosts were hand-built, so required system dependencies were discovered only when a job failed mid-run, and two hosts advertising the same GitHub Actions labels (self-hosted,Linux,X64) could silently drift apart depending on which one had gh/zip/unzip installed. Separately, a playwright install --with-deps failure (sudo needing a terminal) fell back to a Chromium install with no system libs, which surfaced hours later as a misleading generic Playwright error instead of the real libnspr4.so cause.

• internal/runner/manifest.yaml (embedded): the single declarative dependency set — git, jq, yq, gh, make, zip, unzip, curl, docker, build-essential, pkg-config, libssl-dev, and the full Playwright/Chromium runtime lib list — with a reason on every entry tying it back to the incident that added it.
• internal/runner.Executor: local or SSH (reusing internal/deploy's exported SSH primitives, no second SSH code path), so every provision/verify step is one command string a test can assert against without touching a host.
• nself runner verify [--host ...]: runs the manifest against one or more hosts and renders a text (or --json) parity matrix, with explicit DriftFindings when the same check disagrees across hosts — the scenario that hid for hours on 2026-09-11. Includes a dedicated ldd-based check against any cached Chromium binary.
• nself runner provision [--host ...]: idempotently installs the manifest's packages, creates the runner user with passwordless sudo, and registers N runner instances as systemd services via the runner's own svc.sh. Refuses outright (does not silently replace) if the shared _work directory is a symlink — git resolves symlinks before matching includeIf.gitdir:, so a symlinked _work silently breaks actions/checkout's credential injection (fatal: could not read Username for 'https://github.com'), which is what destroyed 63 jobs.
• Registered runner in the command group table (advanced) and the error-harness coverage table; regenerated the CLI command inventory (SPORT F02 mirror, .github/wiki/Commands.md, new cmd-runner.md).

Kept compatible with the P7-E5-W4-S1-T4 "runner fleet v1" ticket, which is nself ci serve's own RoleCI/Prober dispatch across boxes running nSelf's built-in CI daemon — a different concern from provisioning/auditing the GitHub Actions self-hosted runner host itself. No naming or package overlap.

Test plan

• go build ./... — clean
• go vet ./... — clean
• gofmt -l on every changed file — clean
• golangci-lint run ./internal/runner/... ./cmd/commands/... — 0 issues
• go test ./internal/runner/... ./cmd/commands/... — all pass (95.9% coverage on internal/runner); tests use a fake Executor recording command strings, never a real host or network call
• make wiki-check — all 51 wiki command pages current, all links resolve
• gitleaks scan — no findings in any new file
• Reviewer: confirm --host/SSH flag naming reads well against the eventual P7-E5-W4-S1-T7 LAN hardware verification ticket