refactor: move ioc logic from ansible to the gitea runner

The ioc install/start/restart logic moves out of the ansible playbooks and
the 'agebd ioc ...' cli into scripts run by the gitea runner:

- ioc-install.sh / ioc-restart.sh run on the runner itself
- ioc-start.sh triggers the shellbox commands over ssh
- ioc-for-services.sh runs an action for one or all services

They read the deployed ioc files from /sls instead of cloning the repo on
the target host, so a service has to be deployed before its ioc can be
installed. The deploy script therefore also takes over the environment
suffix renaming of the subs/parameters files that ansible used to do, and
the workflow steps are ordered deploy -> install.

The commented-out ioc placeholders in the add-new-service workflow are
filled in, and a manually triggered 'Ioc' workflow replaces the removed
cli commands.

With this, nothing uses ansible anymore, so the ansible dir, the cli ioc
commands and the ansible dependencies are removed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJTevZiSsHepW2xnJGQY49

docs/developer/cicd_runner.md

@@ -3,9 +3,11 @@
 ## Hosts
 
 - `sls-vserv-bd-01(-dev)`
-    - Runs shellbox commands (and `ioc install ...`?)
+    - Runs the shellbox commands, which the runner triggers over `ssh`
+      (see `.gitea/scripts/ioc-start.sh`)
 - `sls-vserv-bd-hla01(-dev)`
-    - Runs everything else
+    - Runs the runner itself, and therefore everything else: the deployments
+      to `/sls/bd/hla/<env>/` and the `ioc ...` commands
 
 ## Setup