Add Forgejo Actions workflow templates and repo promotion helper

Canonical ci-smoke, container-build-push, and multirepo build templates for
railiance01 runners. Documents adoption path for tier 1-3 repos.

docs/forgejo-actions-workflow-templates.md

@@ -0,0 +1,66 @@
+# Forgejo Actions Workflow Templates
+
+Date: 2026-07-04  
+Owner: `railiance-enablement` (S4)  
+Workplans: `RAIL-HO-WP-0005-T08`, `CUST-WP-0054-T04`
+
+## Purpose
+
+Canonical, copy-ready Forgejo Actions workflows for the railiance01 runner
+substrate (`railiance01-build-01`, ADR-004). Forgejo/Gitea Actions on our
+runners do **not** support `actions/checkout@v4` on the non-root host runner;
+use **archive checkout** via `wget` instead.
+
+Templates live in `workflows/` at repo root. Consumer repos copy into
+`.forgejo/workflows/` and adjust `IMAGE_NAME` / `EXTRA_REPOS` as needed.
+
+## Runner labels
+
+| Label | Use |
+| --- | --- |
+| `self-hosted` | Host runner routing smoke, lightweight probes |
+| `ubuntu-latest` | Container-isolated smoke (label routing) |
+| `container-build` | DinD image build + registry push |
+
+Org secrets (set on `coulomb` org): `REGISTRY_USER`, `REGISTRY_TOKEN`.
+
+## Templates
+
+| File | Tier | When to use |
+| --- | ---: | --- |
+| `workflows/ci-smoke.yaml` | 1 | Git+CI routing drill; infra/docs repos |
+| `workflows/container-build-push.yaml` | 2 | Single-repo `Dockerfile` image publish |
+| `workflows/container-build-push-multirepo.yaml` | 3 prep | Docker build with named contexts (e.g. `state-hub` + `hub-core`) |
+
+## Adoption
+
+```bash
+mkdir -p .forgejo/workflows
+cp /path/to/railiance-enablement/workflows/ci-smoke.yaml .forgejo/workflows/
+# For images:
+cp /path/to/railiance-enablement/workflows/container-build-push.yaml .forgejo/workflows/image.yaml
+# Edit IMAGE_NAME=coulomb/<repo>
+git add .forgejo/workflows && git commit -m "Add Forgejo CI from enablement templates"
+git push origin main
+```
+
+## Proven consumers
+
+| Repo | Template | Evidence |
+| --- | --- | --- |
+| `coulomb/glas-harness` | `ci-smoke` (in-repo) | Tier 1 pilot |
+| `coulomb/key-cape` | `container-build-push` (in-repo) | Tier 2 pilot |
+| `coulomb/railiance-*` | `ci-smoke` | Tier 2.5 promotion (2026-07-04) |
+
+## Constraints
+
+- Do not use `actions/checkout@v4` on `self-hosted` / `container-build` runners.
+- Static `docker` binary via wget; runner image is non-root and cannot `apk add`.
+- Reusable `workflow_call` across repos is not relied on; copy templates instead.
+- Runner substrate and labels: `railiance-forge/docs/ci-runner-actions-gitops-ownership.md`.
+
+## References
+
+- `the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`
+- `railiance-apps/docs/forgejo-on-railiance01.md`
+- `docs/adr/ADR-004-forgejo-in-cluster-actions-runner.md` (in `railiance-infra`)