Add Forgejo T05 verify, operator bootstrap, and security hardening

Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.

helm/forgejo-values.yaml

@@ -56,6 +56,10 @@ gitea:
       DISABLE_SSH: false
     service:
       DISABLE_REGISTRATION: true
+    security:
+      INSTALL_LOCK: true
+    session:
+      COOKIE_SECURE: true
     mailer:
       ENABLED: true
       FROM: forgejo@coulomb.social