feat(github-runner): add top Linux repo runners

apps/github-runner/README.md

@@ -0,0 +1,38 @@
+# github-runner
+
+ArgoCD-managed repo-scoped Linux GitHub Actions runners for FlowerCore.
+
+`astoltz` is a GitHub user account, not an organization, so each repository
+needs its own runner registration. The existing Common runner remains
+`Deployment/github-runner`; Sprint 29 adds one single-replica Deployment for
+each top Linux-cost repo:
+
+- `FlowerCore.Puppet`
+- `FlowerCore.Signage`
+- `FlowerCore.DMS`
+- `FlowerCore.Telephony`
+- `FlowerCore.Print.Web`
+- `FlowerCore.Chat`
+- `FlowerCore.MySQL`
+- `FlowerCore.Kiosk.Linux`
+
+Each runner uses `myoung34/github-runner:latest`, `EPHEMERAL=true`, and labels
+`self-hosted,linux,fc-build-linux`. The shared `github-runner-token` Secret is
+synced from the existing 1Password item `GitHub PAT (Runner Registration)` and
+is consumed as `ACCESS_TOKEN`.
+
+Do not `kubectl apply` this app over ArgoCD. Merge to `main`, let
+`infra-github-runner` sync, then verify from `noc1`:
+
+```bash
+kubectl -n github-runner get deploy,pods,pvc
+
+for repo in FlowerCore.Puppet FlowerCore.Signage FlowerCore.DMS FlowerCore.Telephony FlowerCore.Print.Web FlowerCore.Chat FlowerCore.MySQL FlowerCore.Kiosk.Linux; do
+  gh api "/repos/astoltz/$repo/actions/runners" \
+    --jq '.runners[] | select((.labels[].name == "fc-build-linux") and (.status == "online")) | {name,status,busy,labels:[.labels[].name]}'
+done
+```
+
+`LinuxRunnerOffline` is declared in `apps/monitoring/noc-monitoring.yaml` and
+fires when any Common or top-8 Linux runner deployment has no available replica
+for 10 minutes.