Seal remaining Gitea secrets: API token, runner token, pull secret

All placeholder secrets replaced with real sealed values:
- argocd-gitea-token: API token for ArgoCD PR generator
- gitea-runner-token: registration token for in-cluster runner
- gitea-pull-secret: registry credentials for app image pulls

infra/kubernetes/platform/gitea-runner/gitea-runner-token-sealed.yaml

@@ -1,5 +1,3 @@
-# PLACEHOLDER: Generate token from Gitea admin panel, then re-seal with:
-# ./scripts/seal-secret.sh gitea-runner-token platform token=<registration-token>
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -8,7 +6,7 @@ metadata:
   namespace: platform
 spec:
   encryptedData:
-    token: PLACEHOLDER_SEAL_ME
+    token: AgCHDopgQ5g3/nGkAWEFZOgxO2aMQ0Nd0IAgkKn4QXqcz9167z+rtSNzdl0wFCYXRaFHIN6gStUkd/n7SDf+LE22/nKoKwGgpMX2oLzNgojQ3NgEX3gYkVpYqkzm9/sK+ZplM+/2JI2/po/yPdjK8PEQGozfDByKW8Rc75ogwaIfAGYcTjh1QavHlEn+omkOmFkhBR7jpLx9vugQjdXbz/K/qkHBrdDLncFpOuCXvt+c3XqCKYEyqn4vf3gznF2ju8FgmbFutDqiXDD3/T8alMXone0zTk6NXWYBoJaOtOO7Vll+CS/dwHNyn+9S1RvmNHr1HwPejq9XfUmTpzO8Wv/UxhjfXQW8yvIv9Wty/oAXTnnceH8MhmKz9DNwZTvgH+dZdetR9m9e77xuA9WMapVy9Rz3kvyJdgl+eMuO8pJcf+DBqrHqlL99/LAFLlZdfEp/ADcXBmkymr0Sqv0cA1/rL4M5jFmSUPYDUdA3TVLLq3GmUM4MYgI9D7eDqXqbXk00DcjiH+62qbAAe/t3en45qi9Y13eepMTC/mCVt1XW2J1fZYwJEvWSEjWmggNYDPmNJ7nA1L+h+Wt0tIN77XoxVpSs1Zatp3DdIQY2AWla7SDG1Q35ztBhkTvehfhnf0EOO4fmMiaQwnef49wW0ZZIS6bjGF3bPIkB2S4SOsNW0YgDa5nglYjFbNNc2I6gq7buVHfJ6JepJXng6idEJu44VuarxC7kz47x172zq8PiWimCOHEgSPXn
   template:
     metadata:
       name: gitea-runner-token