#17 Chore/atomic cleanup 25 commits

Summary by cubic

Split the runner-facing base URL from the public URL so runners and job-side programs use AKSH_RUNNER_URL (loopback by default). This removes Cloudflare tunnel hairpinning and keeps local CI running during tunnel outages.

• Refactors

  • Added runner_base_url() and switched runner/broker endpoints, connectionData, Twirp artifact/cache/results URLs, OIDC issuer, and live-log WebSocket to use it.
  • preloop serve now sets AKSH_PUBLIC_URL (for GitHub links) and, if unset, AKSH_RUNNER_URL to http://127.0.0.1:<port>; removed LAN IP detection; local runner pool targets the runner URL; control bridge uses the runner origin.
  • Updated docs and benchmarks: conformance report now PASS (light profile), added skip-CI labels, and documented origin routing and tunnel hairpin behavior.

• Migration

  • Remote runners: set AKSH_RUNNER_URL to a host-reachable address.
  • No action needed for default local preloop serve; it configures AKSH_RUNNER_URL automatically.