chore(release): 2.0.0

[jcardozo-eth]

Summary

2.0.0 reworks the configuration surface into something simpler to write and harder to get wrong, and brings a set of improvements for standalone hosts. Settings group into per-concern structs, every default lives in the module and merges deep across Hiera layers so node data holds only its deviations, and the values the module can derive for itself (file ownership, socket paths, DOCKER_HOST) are no longer parameters to set, for simplicity. A shipped Hiera data check validates consumer data against the declared parameter surface and fails loud on an unknown key. Standalone hosts gain a self-contained runbook, a liveness healthcheck decoupled from the self-update loop, and enforced subordinate-ID widths sized for nested builds with rootless BuildKit. It is a breaking change: node data written for 1.x must be migrated.

Changes

• Rename the Unreleased changelog section to 2.0.0 and open a fresh Unreleased.
• Bump metadata.json to 2.0.0.
• Finalize the changelog entries and update a runner_tokens reference in the README prose.

The feature work released here already landed on main through earlier merges; see the CHANGELOG for the complete list.

Breaking changes and migration

2.0.0 is a major version upgrade. Node data must be rewritten from the flat parameters to the grouped structs (runner_account, configuration_file, packages with its sources, rootless_docker, runner_service, and standalone with the nested self_update). Rename the tokens key to runner_tokens in both host data and the secret store file. Several 1.x parameters are gone because the module now derives or fixes their values; the Removed section of the CHANGELOG lists them. Because a mistyped subkey now fails the compile rather than being ignored, the first apply on migrated data surfaces any leftover 1.x keys immediately.

Verification

• just check green (validate, lint, docs).
• From-zero greenfield apply exercised on a production-like host: idempotent re-apply, rootless Docker as the runner user, and runner registration all verified.