ci: cut over to Forgejo (add forgejo ci + publish, retire gitea workflows)

Adds .forgejo/workflows/ci.yml (black/flake8/pytest) and publish-python-package.yml
(twine → forgejo PyPI), modeled on issue-core. Removes the frozen-gitea ci.yml and
publish workflows. CUST-WP-0059 T02-T04.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/publish-python-package.yml

@@ -0,0 +1,41 @@
+name: Publish Python package
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch source archive
+        env:
+          REF: ${{ github.sha }}
+        run: |
+          set -eu
+          mkdir -p buildctx
+          wget -qO /tmp/repo.tar.gz \
+            "https://forgejo.coulomb.social/${GITHUB_REPOSITORY}/archive/${REF}.tar.gz"
+          tar xzf /tmp/repo.tar.gz -C buildctx --strip-components=1
+
+      - name: Set up Python
+        run: |
+          python3 -m pip install --upgrade pip build twine
+
+      - name: Build and validate distributions
+        working-directory: buildctx
+        run: |
+          python3 -m build
+          python3 -m twine check dist/*
+
+      - name: Upload to Forgejo PyPI
+        working-directory: buildctx
+        env:
+          TWINE_USERNAME: ${{ secrets.FORGEJO_PYPI_USER }}
+          TWINE_PASSWORD: ${{ secrets.FORGEJO_PYPI_TOKEN }}
+        run: >-
+          python3 -m twine upload
+          --repository-url https://forgejo.coulomb.social/api/packages/coulomb/pypi
+          dist/*