fix(forgejo-runner): validate label executor scheme

- Set default runner label to 'self-hosted:docker://…'\n- Add an early assert to fail fast when labels use an invalid executor scheme

roles/forgejo_runner/defaults/main.yml

@@ -2,4 +2,4 @@
 forgejo_runner_force_reregister: false
 
 forgejo_runner_labels:
-  - docker:docker://ghcr.io/catthehacker/ubuntu:act-22.04
+  - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04

roles/forgejo_runner/tasks/main.yml

@@ -8,6 +8,15 @@
   set_fact:
     forgejo_runner_labels_csv: "{{ forgejo_runner_labels | join(',') }}"
 
+- name: Fail if Forgejo runner labels have an invalid executor scheme
+  assert:
+    that:
+      - item is match('^[^:]+:(docker|host|shell)://')
+    fail_msg: >-
+      Invalid Forgejo runner label '{{ item }}'.
+      Expected format like '<label>:docker://<image>' (e.g. 'self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04').
+  loop: "{{ forgejo_runner_labels }}"
+
 - name: Fail if Forgejo runner registration token is missing
   fail:
     msg: "FORGEJO_RUNNER_REGISTRATION_TOKEN is required"