[macos-runner] Replace SSH-based VM wake/sleep with a dedicated runner container

Drop the SSH + restricted-key design entirely. wake/sleep now runs on a
new macos-ctl runner (its own Docker container on the VPS, Docker socket
mounted) which runs docker start/stop macos directly on the sibling
container - no SSH indirection, and no borrowing of another project's
runner (pedifoods-web) to do it.

.gitea/workflows/beta.yml

@@ -7,19 +7,10 @@ on:
 
 jobs:
   wake-macos-vm:
-    runs-on: pedifoods
-    container:
-      image: alpine:3.20
+    runs-on: macos-ctl
     steps:
-      - name: Install ssh client
-        run: apk add --no-cache openssh-client
       - name: Start macOS VM container
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
-            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} start
+        run: docker start macos
 
   build-and-upload:
     needs: wake-macos-vm
@@ -64,16 +55,7 @@ jobs:
   sleep-macos-vm:
     needs: build-and-upload
     if: always()
-    runs-on: pedifoods
-    container:
-      image: alpine:3.20
+    runs-on: macos-ctl
     steps:
-      - name: Install ssh client
-        run: apk add --no-cache openssh-client
       - name: Stop macOS VM container
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.VPS_SSH_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 \
-            ${{ secrets.VPS_SSH_USER }}@${{ secrets.VPS_SSH_HOST }} stop
+        run: docker stop macos