ci: run socket-free jobs on the light label

Both runners carry `light` (host1, and host2 over the wg-hosts link), so
these jobs run on whichever host is free. Jobs that mount the docker socket
keep `runs-on: docker`, which only host1 has.

.gitea/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
   # against the placeholder too.) The image build does its own frontend build
   # in the Dockerfile.
   web:
-    runs-on: docker
+    runs-on: light
     container:
       image: node:26-bookworm-slim@sha256:582460f614631b59b824ac6020533b9bf339c7fdf3a6d7db31abb6b4065f0212 # 26-bookworm-slim
     env:
@@ -51,7 +51,7 @@ jobs:
 
   go:
     needs: [web]
-    runs-on: docker
+    runs-on: light
     container:
       image: golang:1.27-bookworm@sha256:69a7b9788769bec032d238959b61854e9ae87f57be9029ec04e9885fabf99195 # 1.27-bookworm
     steps: