ci: add dedicated OTClient and OTS runner stack

[blakinio]

Objective

Provide isolated Synology GitHub Actions runners dedicated to OTClient and OTS work, and make the OTClient runner the canonical execution environment for OTCLIENT-TIBIA-RE.

Scope

• otclient-runner -> blakinio/otclient;
• ots-runner -> blakinio/Otheryn;
• separate persistent state/work volumes;
• immutable official GitHub runner image pin;
• repository-scoped short-lived registration token flow;
• no Docker socket and no privileged runner;
• separate otclient-tibia-re Docker build target for the official-client RE runtime dependencies;
• OTClient runner labels include otclient,ot,synology,tibia-re.

OTCLIENT-TIBIA-RE canonical runtime

After Synology redeploy:

runner_name: synology-otclient-01
selector: [self-hosted, Linux, X64, otclient, tibia-re, synology]
persistent_programme_state: /home/runner/_work/_otclient_tibia_re_state
consumer: PR #48

Historical Oteryn Platform/Freqtrade/oteryn-staging runner stacks are not runtime dependencies for new programme work.

Validation

Exact implementation head e97cf8be1b2a8c63cecc39e07d0347830b874d5f passed Docker validation run 31679256871, job 94380701487:

• shell syntax: PASS;
• docker compose config: PASS;
• base target build: PASS;
• otclient-tibia-re target build: PASS;
• GDB/Xvfb/proxychains/xdotool/Vulkan and Python elftools/YAML inspection: PASS.

The temporary validation workflow was removed after the proof. Detailed durable state is in docs/agents/tasks/active/OTC-20260812-dedicated-ot-runners.md.

Remaining runtime gate

The updated stack must still be rebuilt/recreated on the Synology Docker host. Then:

1. synology-otclient-01 must register with tibia-re;
2. PR ci: prove official Tibia login without OCR on Synology #48 canonical bootstrap must be accepted by that exact runner;
3. persistent OTClient state must be writable and survive into a subsequent job;
4. synology-ots-01 must remain available in blakinio/Otheryn.

Current GitHub connector cannot list repository runners (403) and this session has no authorized NAS/SSH execution tool, so host deployment remains an external runtime gate rather than an unverified completion claim.

No Codex, OpenAI API or owner-funded AI quota is used. All material migration state is persisted in blakinio/otclient.

[blakinio]

Track A coordinator dependency disposition: REJECT / SUPERSEDE AS AN ACTIVE OTCLIENT-TIBIA-RE DEPENDENCY.

Reasons verified from the current PR state:

• the PR is still an infrastructure-wide runner-stack change, not a bounded Track A research slice;
• its exact head eda8714acc943a342d1527ab2b67265ba9d784c8 has failing repository CI (actionlint on the historical oteryn-staging runner label / workflow shape);
• current Track A isolation forbids using historical Oteryn runners/containers as active dependencies;
• later exact-build Track A evidence already proves synology-otclient-01 has executed Track A jobs, so the old 'no Track A self-hosted runner available' blocker is superseded as a current fact.

This comment does not close or reject the PR's broader OTClient/OTS infrastructure design. That remains intentionally owned by the infrastructure programme. Track A simply no longer waits on or derives runtime authority from this PR.

[blakinio]

Coordinator live-state correction (2026-08-16): the old WAITING_ON runner availability/deploy narrative is no longer current authority. Physical Track A run 31952484701 / job 95177998199 was accepted by synology-otclient-01 with selector [otclient, synology], acquired canonical lease generation 1 and executed trusted-main bootstrap code until the separately tracked fail-closed Xvfb/toolroot defect. Therefore the dedicated OTClient runner is currently a proven reachable execution channel; do not use #280's historical offline/queued observations as a blocker for Track A. This PR still contains unmerged declarative runner-stack infrastructure, so it is not being closed here. Any future promotion of that infrastructure must be fresh-main reconciled and must not assume the historical tibia-re label is currently registered merely because the runner itself is reachable.