deploy: move the forge CI runner toggle out of swarm

Last of the swarm.* -> deploy.* moves for the enable-shaped options.
Whether this host also runs the CI runner is a per-machine decision, so
it was sitting in the namespace that has to be identical swarm-wide.

Renames all five options, not just enable: name, concurrency, labels and
package all describe the runner THIS host would run, and leaving them
behind would keep the original defect for four more options. One rename
entry each, because ci is a plain attrset rather than a submodule type,
so there is no parent path to rename in one go.

deploy.forgejo is the name deploy.nix's own header already specifies,
including this exact case -- "ci (does this host run the runner too) is
exactly that shape". It is the only entry with no enable: the forge is
not optional, it deploys with hyperhive itself, so running the runner is
the only deployment decision it has.

Also fixes hive-c0re/src/forge/ci_runner.rs, whose doc comment named
services.hyperhive.forge.ci.enable -- missing the swarm. segment, so it
had never resolved to a real option.

hive-c0re/src/forge/ci_runner.rs

@@ -23,7 +23,7 @@ const RUNNER_FILE: &str = "/var/lib/nixos-containers/hive-ci/var/lib/gitea-runne
 
 /// Whether the operator enabled the CI runner. The nix module sets
 /// `HYPERHIVE_FORGE_CI_ENABLED=1` on `hive-c0re.service` when
-/// `services.hyperhive.forge.ci.enable` is on; absent means CI is off and
+/// `services.hyperhive.deploy.forgejo.ci.enable` is on; absent means CI is off and
 /// there is no hive-ci container to register a runner for.
 fn ci_enabled() -> bool {
     std::env::var("HYPERHIVE_FORGE_CI_ENABLED")