Document runners, and check the three files that describe one agree

Document runners, and check the three files that describe one agree

A runner is a second decision after the forge, not part of its first boot:
it executes repository code, it can read every secret a job declares, and
the allowlist that lets it take work is per repository. The guide says what
the deployment creates, how to set one up on a machine you already have, the
one step only an admin can do, what to know before giving it a repository,
and how to upgrade it.

render.sh now renders either first-boot file, taking its placeholder list
from the render line it uses, so the checker reads the same line instead of
keeping a second copy.

check-deploy.py renders both templates, requires each one's promised files
with literal modes, and holds the runner's three descriptions together: the
template writes the arguments, the unit reads them, and the package ships
the example an operator copies. A name that drifts leaves a machine enabled
and idle, which looks exactly like a runner that is working.