Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate

STEP 1 — enable Gitea Actions: pin GITEA__actions__ENABLED=true and
DEFAULT_ACTIONS_URL=github in the gitea bootstrap patch (was implicit upstream
default; make it a declared property).

STEP 2 — deploy + register an act_runner in a dedicated non-app namespace
(gitea-actions) so the privileged DinD executor sidecar is admitted without a
Kyverno policy exception (restrict-host-namespaces scopes to app namespaces only).
Docker executor + DinD sidecar over a shared TLS-cert emptyDir; runner state on a
Longhorn PVC (registers once). Registration token delivered as a SOPS-encrypted
Secret decrypted by Flux. Runner mounts no ServiceAccount token (R-SEC-02).

STEP 3 — author .gitea/workflows/gate.yml: the live enforced merge gate running
the STATIC layers (spec-immutability best-effort, lint, Kyverno L0, L1 render) via
`make -C ci lint l0 l1` with the pinned toolchain installed at job start. L2/L3
conformance is an if:false placeholder (needs a toolchain image + scoped cluster
creds — a design decision, not wired). merge-gate.yaml reduced to workflow_dispatch
(dormant full-pipeline blueprint). install-tools.sh gains check-jsonschema so the
schema stage validates in CI instead of skipping.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.gitea/workflows/merge-gate.yaml

@@ -20,18 +20,23 @@
 # CI holds NO broad kubeconfig. L2/L3 run as an in-cluster Chainsaw Job whose own
 # scoped ServiceAccount holds cluster access (docs/14, R-SEC-02); CI uses only a
 # narrow trigger credential referenced BY SECRET NAME below.
+#
+# ─────────────────────────────────────────────────────────────────────────────
+# DORMANT (Phase 6, WS-GITOSS): the LIVE enforced gate is now gate.yml. This file is
+# retained as the full-pipeline BLUEPRINT (spec-checkout via SPEC_REPO_SLUG + the L2/L3
+# conformance job + the R-TEST-03 decision job) for when those seams are wired:
+#   - SPEC_REPO_SLUG must be set as a Gitea repo/org variable AND the spec repo hosted on
+#     this Gitea, or spec-immutability's second checkout fails the whole run.
+#   - vars.CLUSTER_AVAILABLE + a scoped conformance trigger credential must exist.
+# Until then it must NOT auto-run (its spec checkout would fail with SPEC_REPO_SLUG unset),
+# so its triggers are reduced to manual `workflow_dispatch`. Re-enable by restoring the
+# pull_request/push triggers once the seams above are wired.
+# ─────────────────────────────────────────────────────────────────────────────
 ---
 name: merge-gate
 
 on:
-  pull_request:
-    branches: [main]           # PRs are the enforced merge gate into main (CONTRIBUTING.md)
-  push:
-    branches:
-      - 'feature/**'           # feature-branch -> main workflow (no work on main)
-      - 'fix/**'
-      - 'docs/**'
-      - 'chore/**'
+  workflow_dispatch: {}        # DORMANT blueprint — manual-only; gate.yml is the live gate
 
 concurrency:
   group: merge-gate-${{ github.ref }}