docs: remove plaintext bot secret, update runner image references

Credentials moved to Gitea user-scope vault — removed from README.
Architecture diagram and songs pipeline deps section updated to reflect
prebuilt novoyuuparosk-wiki-runner:latest image (no runtime dep installs).
Noted workflow stubs in .gitea/workflows/ may be stale.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pipelines/songs/README.md

@@ -58,9 +58,9 @@ Triggers:
 
 ## Dependencies
 
-- Python 3.12+ (job container: `python:3.12-slim`)
-- Pandoc (apt-installed in the job container)
-- `python-frontmatter`, `mwclient`, `PyYAML` — see `requirements.txt`
+Job container: `novoyuuparosk-wiki-runner:latest` (pre-built, stored in the local Docker daemon on the runner host). Bakes in Python 3.12, Pandoc, and all pipeline Python packages — no install steps at job runtime.
+
+See the `Dockerfile` at the repo root and `requirements.txt` in this directory. Rebuild the image after changes to either.
 
 ## Modes