docs(runner): rewrite GITLAB-RUNNER.md for userns-remap disabled
Doc-only. GITLAB-RUNNER.md described the userns-remap-ON state with only a top note. Rewrote all sections (architecture diagram, security table, prereqs, variables, verify, cap_drop, troubleshooting) to reflect userns-remap OFF as the current state, why (buildkit conflict → ADR 0001), and re-enable guidance. No code change.