Pin valkey/postgresql resources; harden runner token step

The live valkey and postgresql StatefulSets had memory limits raised by
hand (8Gi and 2Gi). A helm upgrade reverts those to the bitnami 192Mi
preset, and valkey then OOMs loading its ~3.3GB dataset. Move the limits
into role defaults so upgrades keep them.

Generate the runner token with kubectl exec against the deployment after
waiting for its rollout, with retries, instead of kubernetes.core.k8s_exec
(the control plane's kubernetes python client is too old for it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -6,6 +6,27 @@
 # 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
 gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
 
+# Resources for chart subcharts. These match the limits previously set by
+# hand on the live StatefulSets; the bitnami default presets (192Mi) OOM.
+gitea_valkey_resources:
+  requests:
+    cpu: 100m
+    memory: 1Gi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 8Gi
+    ephemeral-storage: 4Gi
+gitea_postgresql_resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+    ephemeral-storage: 50Mi
+  limits:
+    cpu: 150m
+    memory: 2Gi
+    ephemeral-storage: 2Gi
+
 # Gitea Actions runner (gitea/actions chart)
 gitea_actions_enabled: true
 gitea_actions_chart_version: 0.1.2