ci: make Windy Git CI permanent for the private repos

- Four runners x capacity 1 instead of one x capacity 4. Concurrent jobs in
  one act_runner share /root/.cache/act; a refresh racing a copy killed 3 of
  windy-chat's ~20 jobs at setup-node (lstat ... no such file). Separate
  processes have separate caches. Same parallelism, same capped dind.
- Behavioral tests for pr_status_bridge (latest verdict wins, no reposting,
  skipped never painted green, fork PRs never run, pagination, PR lifecycle).
- import_from_github.py reads IMPORT_GITEA_URL, not GITEA_BASE_URL: sourcing
  the deploy .env pointed it at http://gitea:3000 and it died on DNS after the
  mirror it replaces had already been deleted.
- CUTOVER.md: the private-repo CI path, onboarding steps, and the
  /actions/tasks-hides-queued-runs trap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/runner/config.yaml

@@ -11,7 +11,7 @@ log:
 
 runner:
   file: /data/.runner
-  capacity: 4          # concurrent jobs; Veron has 24 cores, dind is capped at 12
+  capacity: 1          # per runner; parallelism = number of runner services (4). See docker-compose.yml
   timeout: 30m
   shutdown_timeout: 3m
   insecure: false