gitea-runner: detect existing LXC on re-run, refresh OS on update

Ports openbao's host-side update path to gitea-runner: main() now uses
find_existing_lxc (hostname/tag match) to switch into a new update_lxc()
instead of always recreating the container, with an explicit --update
dispatch case reaching update_runner() (previously inferred only from
/usr/local/bin/act_runner presence). require_root is ported from openbao
for the host-side pct branch.

Extracted a small exec_in_lxc() helper (option a from the two offered)
rather than duplicating the curl-pipe invocation, since main() now needs
to drive both the create and update paths through the same piping logic
with only the trailing --install/--update flag differing — matching
openbao's own exec_in_lxc for consistency.

update_runner() now calls refresh_os_packages before touching the binary,
mirroring openbao's update_inside_lxc(). Also switched create_lxc's LXC
tag from the hardcoded "cicd" to the LXC_TAG variable (added in the prior
commit but unused until now) so find_existing_lxc's tag match actually
works.

Documented the OS-refresh-on-update behavior in both READMEs.

Closes #15

openbao/README.md

@@ -110,7 +110,9 @@ curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/feat/lxc-Open
 
 The script auto-detects the presence of `/usr/local/bin/bao` and switches to
 update mode. The OpenRC service is stopped, the binary is swapped (the old one
-is kept as `bao.bak.<ts>`), then the service is restarted.
+is kept as `bao.bak.<ts>`), then the service is restarted. Re-running from the
+Proxmox host does the same, plus refreshes the LXC's Alpine packages first
+(`apk update && apk upgrade`).
 
 ### Architecture