Pin check/renovate back to brick-build now that its image has Node

The runner's label-to-image mapping got repointed at Gitea's own
official runner image (docker.gitea.com/runner-images:ubuntu-latest,
has Node out of the box) — the earlier opensuse/leap:16.0 mapping for
brick-build specifically was what broke check/renovate on 2026-09-12,
not brick-build the label itself. Back to pinning both to this
machine specifically instead of whichever runner answers to the
shared ubuntu-latest label.

docs/deployment.adoc

@@ -7,16 +7,19 @@ MapTool deploys as a Podman container (via `podman compose`, driven by a
 the Gitea Actions runners run on. Two separate runners are registered
 against the Gitea instance:
 
-* The existing Docker-based runner (`gitea/runner:3`), labels
-  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04` — runs the `check` and
-  `renovate` jobs in a fresh, isolated container per job, same as
-  before. It's also registered under `brick-build`, but that label's
-  job container (`opensuse/leap:16.0`) has no Node.js, which every step
-  in `check`/`renovate` needs (they're JS-based Actions) — until that
-  image gets Node, or the label points elsewhere, `check`/`renovate`
-  stay on `ubuntu-latest`. That label is shared with "Gitea Runner on
-  Cube" too, so a `check`/`renovate` run isn't pinned to this specific
-  machine — harmless, since only `deploy` actually needs a specific box.
+* The existing Docker-based runner (`gitea/runner:3`), label
+  `brick-build` — runs the `check` and `renovate` jobs in a fresh,
+  isolated container per job. Every label on this runner (including
+  `ubuntu-latest`/`ubuntu-24.04`/`ubuntu-22.04`, still registered but no
+  longer what `check`/`renovate` pin to) now maps to Gitea's own
+  official runner image (`docker.gitea.com/runner-images:ubuntu-latest`,
+  has Node out of the box) — an earlier `opensuse/leap:16.0` mapping for
+  `brick-build` specifically had no Node, which every step in
+  `check`/`renovate` needs (they're JS-based Actions), and briefly broke
+  both jobs (2026-09-12) until reverted to the shared `ubuntu-latest`
+  label; now that the image itself is fixed, both are pinned back to
+  `brick-build` — this machine specifically, not whichever runner
+  happens to answer to the shared label (e.g. "Gitea Runner on Cube").
 * A dedicated native runner, installed directly on the host (no Docker
   around it), label `brick-host` — runs only the `deploy` job.