ci: add Gitea Actions pipeline + runner runbook (refs #30)

Add .gitea/workflows/ci.yaml with lint, build, unit, and compose-smoke
jobs on runs-on: respellion-linux; uses: pinned to absolute tagged URLs
(§8.7/§15). Document the runner in docs/runbooks/ci.md: the respellion-
linux label, co-locating act_runner on the Gitea server in host mode,
prerequisites, and a security note.

The lint/build/unit/compose commands are verified locally. End-to-end
"pipeline green" is deferred until a runner is registered, so this refs
(does not close) #30; the issue stays open until CI runs green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -0,0 +1,54 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+# Self-hosted runner — see docs/runbooks/ci.md for the runner setup.
+# `uses:` are absolute, tag-pinned URLs (CLAUDE.md §8.7 / §15).
+
+jobs:
+  lint:
+    runs-on: respellion-linux
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+      - name: dotnet format (verify, no changes)
+        run: dotnet format services/bff/Bff.slnx --verify-no-changes
+
+  build:
+    runs-on: respellion-linux
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+      - run: dotnet build services/bff/Bff.slnx -c Release
+
+  unit:
+    runs-on: respellion-linux
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - uses: https://github.com/actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+      - run: dotnet test services/bff/Bff.slnx -c Release
+
+  compose-smoke:
+    runs-on: respellion-linux
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+      - name: compose up (wait for healthy)
+        run: docker compose -f infra/docker-compose.yml up -d --build --wait
+      - name: smoke test /health
+        run: curl -fsS http://localhost:8080/health
+      - name: compose down
+        if: always()
+        run: docker compose -f infra/docker-compose.yml down --volumes