Add a root Makefile (lint/build/unit/smoke/ci) as the single source of
truth for the checks, and have each Gitea Actions job call the matching
make target so local and CI cannot drift. `make ci` runs the full
pipeline locally — the interim gate while no runner is registered.
The smoke target auto-points DOCKER_HOST at the rootless Podman socket
when present (and DOCKER_HOST is unset), leaving Docker/CI hosts alone.
Document `make ci` and the Podman prerequisites in docs/runbooks/ci.md.
Verified: `make ci` is green locally (lint, build, unit, container smoke).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add .gitea/workflows/ci.yaml with lint, build, unit, and compose-smoke
jobs on runs-on: respellion-linux; uses: pinned to absolute tagged URLs
(§8.7/§15). Document the runner in docs/runbooks/ci.md: the respellion-
linux label, co-locating act_runner on the Gitea server in host mode,
prerequisites, and a security note.
The lint/build/unit/compose commands are verified locally. End-to-end
"pipeline green" is deferred until a runner is registered, so this refs
(does not close) #30; the issue stays open until CI runs green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
