ci: cut over to Forgejo (add forgejo ci + publish, retire gitea workflows)

Adds .forgejo/workflows/ci.yml (black/flake8/pytest) and publish-python-package.yml
(twine → forgejo PyPI), modeled on issue-core. Removes the frozen-gitea ci.yml and
publish workflows. CUST-WP-0059 T02-T04.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch source archive
+        env:
+          REF: ${{ github.sha }}
+        run: |
+          set -eu
+          mkdir -p repo
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C repo --strip-components=1
+
+      - name: Install package and dev tools
+        working-directory: repo
+        run: |
+          python3 -m pip install --upgrade pip
+          python3 -m pip install -e ".[dev]"
+
+      - name: Format check (black)
+        working-directory: repo
+        run: black --check src tests
+
+      - name: Lint (flake8)
+        working-directory: repo
+        run: flake8 src/ --max-line-length=100
+
+      - name: Run tests
+        working-directory: repo
+        run: pytest tests/ -q --ignore=tests/test_cli_error_handling.py

.forgejo/workflows/publish-python-package.yml

@@ -0,0 +1,41 @@
+name: Publish Python package
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch source archive
+        env:
+          REF: ${{ github.sha }}
+        run: |
+          set -eu
+          mkdir -p buildctx
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+
+      - name: Set up Python
+        run: |
+          python3 -m pip install --upgrade pip build twine
+
+      - name: Build and validate distributions
+        working-directory: buildctx
+        run: |
+          python3 -m build
+          python3 -m twine check dist/*
+
+      - name: Upload to Forgejo PyPI
+        working-directory: buildctx
+        env:
+          TWINE_USERNAME: ${{ secrets.FORGEJO_PYPI_USER }}
+          TWINE_PASSWORD: ${{ secrets.FORGEJO_PYPI_TOKEN }}
+        run: >-
+          python3 -m twine upload
+          --repository-url https://forgejo.coulomb.social/api/packages/coulomb/pypi
+          dist/*

.gitea/workflows/ci.yml

@@ -1,38 +0,0 @@
-name: ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    runs-on: haskelseed
-    steps:
-      - name: Check out source
-        env:
-          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-        run: |
-          git clone --depth 1 \
-            "https://tegwick:${PACKAGE_TOKEN}@gitea.coulomb.social/coulomb/kaizen-agentic.git" \
-            repo
-          cd repo
-          git checkout "${{ gitea.sha }}"
-
-      - name: Install package and dev tools
-        run: |
-          cd repo
-          python3 -m ensurepip --upgrade 2>/dev/null || \
-            curl -sS https://bootstrap.pypa.io/get-pip.py -o /tmp/get-pip.py && python3 /tmp/get-pip.py
-          python3 -m pip install --upgrade pip
-          python3 -m pip install -e ".[dev]"
-
-      - name: Format check (black)
-        run: cd repo && black --check src tests
-
-      - name: Lint (flake8)
-        run: cd repo && flake8 src/ --max-line-length=100
-
-      - name: Run tests
-        run: cd repo && pytest tests/ -q --ignore=tests/test_cli_error_handling.py

.gitea/workflows/publish-python-package.yml

@@ -1,41 +0,0 @@
-name: Publish Python package
-
-on:
-  push:
-    tags:
-      - "v*"
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: haskelseed
-    steps:
-      - name: Check out source
-        env:
-          PACKAGE_USER: ${{ secrets.PACKAGE_USER }}
-          PACKAGE_TOKEN: ${{ secrets.PACKAGE_TOKEN }}
-        run: |
-          git clone --depth 1 \
-            "https://${PACKAGE_USER}:${PACKAGE_TOKEN}@gitea.coulomb.social/coulomb/kaizen-agentic.git" \
-            repo
-          cd repo
-          git checkout "${{ gitea.sha }}"
-
-      - name: Build and publish
-        env:
-          TWINE_USERNAME: ${{ secrets.PACKAGE_USER }}
-          TWINE_PASSWORD: ${{ secrets.PACKAGE_TOKEN }}
-          PYTHON_KEYRING_BACKEND: keyring.backends.null.Keyring
-        run: |
-          cd repo
-          python3 -m venv .build-venv
-          . .build-venv/bin/activate
-          python -m pip install --upgrade pip build twine
-          python -m build
-          python -m twine check dist/*
-          python -m twine upload \
-            --username "${TWINE_USERNAME}" \
-            --password "${TWINE_PASSWORD}" \
-            --non-interactive \
-            --repository-url https://gitea.coulomb.social/api/packages/coulomb/pypi \
-            dist/*