chore(github-runner): replicas 1 → 0 until 1Password token provisioned

github-runner-token OnePasswordItem exists but the underlying 1Password
vault item hasn't been created yet, so the operator can't mint the K8s
Secret. Pod stuck in CreateContainerConfigError → DeploymentReplicasMismatch
alert fires.

Scaling to 0 keeps the manifest infrastructure intact but stops trying
to schedule until operator:
1. Creates "GitHub Runner Registration Token" item in IAmWorkin vault
2. Generates a token at github.com/astoltz/<repo>/settings/actions/runners/new
3. Updates the OnePasswordItem itemPath to point at it
4. Bumps replicas back to 1 via PR

apps/github-runner/github-runner.yaml

@@ -111,7 +111,7 @@ spec:
   # one pod at a time. Each pod re-registers as an ephemeral runner after
   # completing a job (EPHEMERAL=true restarts the container, not the pod,
   # so the PVC stays attached between jobs).
-  replicas: 1
+  replicas: 0
   selector:
     matchLabels:
       app.kubernetes.io/name: github-runner