Pin valkey/postgresql resources; harden runner token step

The live valkey and postgresql StatefulSets had memory limits raised by
hand (8Gi and 2Gi). A helm upgrade reverts those to the bitnami 192Mi
preset, and valkey then OOMs loading its ~3.3GB dataset. Move the limits
into role defaults so upgrades keep them.

Generate the runner token with kubectl exec against the deployment after
waiting for its rollout, with retries, instead of kubernetes.core.k8s_exec
(the control plane's kubernetes python client is too old for it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/gitea.yaml

@@ -96,6 +96,9 @@
             DEFAULT_THEME: catppuccin-blue-auto
       valkey:
         enabled: true
+        primary:
+          # The chart's default preset (192Mi) cannot load the existing dataset.
+          resources: "{{ gitea_valkey_resources }}"
       valkey-cluster:
         enabled: false
         replica:
@@ -120,6 +123,7 @@
               password: "{{ gitea_admin_password }}"
               database: gitea
         primary:
+          resources: "{{ gitea_postgresql_resources }}"
           persistence:
             enabled: true
             size: 2Ti