Optionally register the rg-devops-iac VM as a GitHub Actions self-hosted runner

## Summary

Prerequisite for #173 (CD). The CD workflow runs on a self-hosted GitHub Actions runner hosted on
the `rg-devops-iac` Linux Terraform-execution VM. Today that registration would be a **manual**
step; it should instead be a **native, opt-in part of the `rg-devops-iac` configuration** so the
runner is provisioned declaratively (IaC), consistent with the rest of the project.

## Current state

- `extras/configurations/rg-devops-iac/modules/vm-jumpbox-linux` provisions the Linux VM via
**cloud-init** (`scripts/configure-vm-jumpbox-linux.yaml`, wired through
`data.cloudinit_config` → `custom_data`). It already pre-installs IaC tooling and configures
managed-identity-based azurerm provider auth.
- There is **no** GitHub Actions runner agent install or registration.

## Goal

Add an **optional** capability to install and register the GitHub Actions self-hosted runner agent
on the VM as part of provisioning, gated behind a feature toggle (default **off** so existing
behavior is unchanged).

## Acceptance criteria

- [ ] New opt-in variable(s), e.g. `enable_github_runner` (default `false`) plus inputs for the
runner registration target (repo/org URL) and labels.
- [ ] The **registration token / PAT is handled as a secret** (Key Vault secret consumed at
provisioning time), never written to state or committed.
- [ ] cloud-init installs the `actions/runner` agent, registers it against the configured
repo/org with the given labels, and installs it as a **service** so it survives reboots.
- [ ] Runner runs under a non-root service account with the required toolchain on PATH
(terraform, az CLI, pwsh + Az modules — already installed) and uses the VM **managed
identity** for Azure auth (no stored Azure secrets).
- [ ] Local-state durability for CD: ensure the runner work directory / a fixed state path
persists across jobs (so the #173 default local `.tfstate` survives), or document the
`checkout clean:false` + fixed `-state` path requirement.
- [ ] When `enable_github_runner = false`, no runner is installed (no behavior change).
- [ ] README / module docs updated; `terraform validate` / `tflint` pass.

## Notes

- Coordinates with #173 (consumer), #496 (secretless auth — runner uses MI), and the runner-setup
todo in the #173 plan, which this issue replaces with a declarative implementation.

Start with extras/configurations/rg-devops-iac/modules/vm-jumpbox-linux and scripts/configure-vm-jumpbox-linux.yaml, tracing data.cloudinit_config into custom_data. Review #173 and #496 for the CD and managed-identity constraints, then run terraform validate and tflint. Done means the opt-in runner provisions as a non-root service with secret handling, durable work state, and updated README or module docs while the default remains unchanged.

Written by the indexing model from the issue text.