G7: CI runners with real isolation, and the gate as a workflow

I-5 says runners execute untrusted code and must be isolated by machine
boundary. act_runner needs a Docker daemon to start job containers, and the
tempting move — what every published example does — is to mount the host's
/var/run/docker.sock. That hands every workflow, including whatever a
transitive dependency's postinstall script feels like doing, the ability to
start a privileged container mounting / — root on Grant's workstation.

Instead the runner talks to its OWN dind daemon:
  - runner (TRUSTED, the act_runner daemon) sits on the forge network only to
    collect jobs from gitea:3000
  - dind and every job container it spawns are UNTRUSTED, on a private network
    with no route to the forge, its Postgres, or its .env
  - jobs cannot bind-mount from the daemon host (valid_volumes: []) and are not
    handed the runner's own socket (docker_host: -)
  - separate compose project, cpu/memory bounded — Veron 1 is Grant's
    workstation, not a dedicated build box

The gate itself now runs as a workflow, including the migration round-trip that
already caught two bugs review did not, and the I-12 check that a COMMIT_SHA
env override cannot change what /version reports.

Labels are explicit and pinned. A workflow naming a label nobody provides
queues forever and presents as a hung CI system rather than a typo — which is
what ubuntu-latest does on every windy-registry run today.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -0,0 +1,73 @@
+# The gate, running on our own hardware (G7.3).
+#
+# This is the dogfood: windy-git verifies itself before anything else migrates.
+#
+# `runs-on: veron-1` is a label this runner actually provides. NEVER
+# `ubuntu-latest` (G7.5) — a self-hosted runner has no such label, so a workflow
+# naming it queues forever and presents as a hung CI system rather than a typo.
+
+name: check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  gate:
+    runs-on: veron-1
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: windygit
+          POSTGRES_PASSWORD: windygit
+          POSTGRES_DB: windygit
+        options: >-
+          --health-cmd "pg_isready -U windygit"
+          --health-interval 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: install
+        run: |
+          python3 -m venv .venv
+          .venv/bin/pip install -q -e ".[dev]"
+
+      - name: lint
+        run: .venv/bin/ruff check api scripts
+
+      - name: vocabulary audit (D-9)
+        run: python3 scripts/vocab_audit.py
+
+      - name: tests
+        run: .venv/bin/pytest -q
+
+      # G0.4 — a migration nobody has run is a migration nobody can trust. This
+      # is the step that caught two bugs review did not: SQLAlchemy Enum
+      # persisting .name instead of .value, and create_table re-emitting
+      # CREATE TYPE without checkfirst.
+      - name: migration round-trip (upgrade -> downgrade -> upgrade)
+        env:
+          DATABASE_URL: postgresql://windygit:windygit@postgres:5432/windygit
+        run: |
+          .venv/bin/alembic upgrade head
+          .venv/bin/alembic downgrade base
+          .venv/bin/alembic upgrade head
+
+      # I-12 — the honesty check. Nine sibling services cannot name the commit
+      # they are running; one reports another repo's commit entirely.
+      - name: /version must equal HEAD
+        run: |
+          HEAD_SHA=$(git rev-parse HEAD)
+          COMMIT_SHA=deadbeefdeadbeefdeadbeefdeadbeefdeadbeef \
+            .venv/bin/python -c "
+          import os, sys
+          sys.path.insert(0, '.')
+          from api.app.buildinfo import get_build_info
+          info = get_build_info()
+          expected = '$HEAD_SHA'
+          assert info.commit_sha == expected, f'{info.commit_sha} != {expected}'
+          print('I-12 holds: env override ignored, reported', info.commit_sha[:12])
+          "