Add jellyfin-ha container build

Build-orchestration for the jellyfin-ha Jellyfin fork: pins an upstream
commit (UPSTREAM_REF), publishes the .NET 10 server, and builds/pushes the
runtime image to git.unkin.net/unkin/jellyfin-ha on v* tags.

- UPSTREAM_REF pinned to d4f9c12
- Dockerfile.runtime (vendored runtime-only image + jellyfin-web 10.11.6)
- .woodpecker/{build,docker}.yaml (publish + docker-buildx, k8s resources)
- Makefile (publish/build + patch/minor/major release tagging)

.dockerignore

@@ -0,0 +1,7 @@
+# Keep the docker build context small: only publish-output + Dockerfile.runtime
+# are needed. The upstream source clone lives under src/ and must not be sent.
+src/
+.git/
+.woodpecker/
+*.md
+Makefile