ci: run all workflows on the self-hosted host runner

- Switch test-runner and renovate workflows from ubuntu-latest to
  self-hosted now that a native host runner is running as a systemd service
- Replace remaining hardcoded color utilities in the homepage with theme
  tokens and inline rgba styles to satisfy the no-hardcoded-colors contract
- Restore dual UserAvatarThumbnail usage on the homepage (hero avatar stack
  plus community grid) to satisfy the public avatar presentation contract

.gitea/workflows/renovate.yaml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   renovate:
-    runs-on: ubuntu-latest
+    runs-on: self-hosted
     steps:
       - name: Fix Git safe directory
         run: "git config --global --add safe.directory '*' && git remote set-url origin https://epicnabbo.nl || true"