ci: make Windy Git CI permanent for the private repos

- Four runners x capacity 1 instead of one x capacity 4. Concurrent jobs in
  one act_runner share /root/.cache/act; a refresh racing a copy killed 3 of
  windy-chat's ~20 jobs at setup-node (lstat ... no such file). Separate
  processes have separate caches. Same parallelism, same capped dind.
- Behavioral tests for pr_status_bridge (latest verdict wins, no reposting,
  skipped never painted green, fork PRs never run, pagination, PR lifecycle).
- import_from_github.py reads IMPORT_GITEA_URL, not GITEA_BASE_URL: sourcing
  the deploy .env pointed it at http://gitea:3000 and it died on DNS after the
  mirror it replaces had already been deleted.
- CUTOVER.md: the private-repo CI path, onboarding steps, and the
  /actions/tasks-hides-queued-runs trap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/import_from_github.py

@@ -43,7 +43,12 @@ import urllib.request
 #
 # Bulk import belongs on the host anyway: no hairpin through the edge, no
 # Cloudflare ~100s proxy ceiling (G4A.5) on a large clone. Run this on Veron 1.
-GITEA = os.environ.get("GITEA_BASE_URL", "http://localhost:3080")
+#
+# 🔴 Deliberately NOT `GITEA_BASE_URL`: the deploy `.env` sets that to
+# `http://gitea:3000` for the API container, and sourcing `.env` on the host
+# made this script die on DNS *after* a caller had already deleted the mirror it
+# was meant to replace (2026-09-23).
+GITEA = os.environ.get("IMPORT_GITEA_URL", "http://localhost:3080")
 GITEA_TOKEN = os.environ.get("GITEA_ADMIN_TOKEN", "")
 GITHUB_TOKEN = os.environ.get("GITHUB_TOKEN", "")
 GITHUB_OWNER = os.environ.get("GITHUB_OWNER", "sneakyfree")