CI/CD: pipeline execution via external runners #13

#1 gives external CI a way to report results back, but nothing runs pipelines. This issue is native CI/CD.

Design leaning, to fit the single-binary philosophy: gitbayd does not execute jobs. A separate runner binary (gitbay-runner) registers against an instance, receives work via webhooks or polling the JSON API, executes in isolation, and reports through the commit-status API from #1. That keeps sandboxing and its dependencies out of the forge, works for one self-hosted runner or many, and means the forge never executes repository content.

Scope:

• pipeline definition in-repo (.gitbay/ci.toml or similar), triggered on push and MR events (both already emit webhooks)
• runner: isolation story first (containers or VMs, never bare exec), log streaming back, artifact upload later
• results surface as commit statuses on MRs; require-checks branch setting gates merges (also #1)
• depends on #1; notifications for failures tie into #3