Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate

STEP 1 — enable Gitea Actions: pin GITEA__actions__ENABLED=true and
DEFAULT_ACTIONS_URL=github in the gitea bootstrap patch (was implicit upstream
default; make it a declared property).

STEP 2 — deploy + register an act_runner in a dedicated non-app namespace
(gitea-actions) so the privileged DinD executor sidecar is admitted without a
Kyverno policy exception (restrict-host-namespaces scopes to app namespaces only).
Docker executor + DinD sidecar over a shared TLS-cert emptyDir; runner state on a
Longhorn PVC (registers once). Registration token delivered as a SOPS-encrypted
Secret decrypted by Flux. Runner mounts no ServiceAccount token (R-SEC-02).

STEP 3 — author .gitea/workflows/gate.yml: the live enforced merge gate running
the STATIC layers (spec-immutability best-effort, lint, Kyverno L0, L1 render) via
`make -C ci lint l0 l1` with the pinned toolchain installed at job start. L2/L3
conformance is an if:false placeholder (needs a toolchain image + scoped cluster
creds — a design decision, not wired). merge-gate.yaml reduced to workflow_dispatch
(dormant full-pipeline blueprint). install-tools.sh gains check-jsonschema so the
schema stage validates in CI instead of skipping.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/gitea-bootstrap-patch.yaml

@@ -18,6 +18,15 @@
 #     it from a committed SOPS secret pins it across pod restarts/reschedules.
 #   - GITEA__server__ROOT_URL / __DOMAIN -> correct public clone/redirect URLs for the git host
 #     that TLS-terminates at the shared Gateway (gitea.home.keithjackson.dev).
+#   - GITEA__actions__ENABLED=true -> turn on Gitea Actions explicitly (Phase 6 CI/CD, WS-GITOSS).
+#     Gitea 1.21+ defaults Actions ON, but pinning it here makes the CI merge gate a declared,
+#     reviewable property of the deployment rather than an implicit upstream default that a future
+#     version bump could flip. The in-cluster act_runner (ns gitea-actions) registers against it.
+#   - GITEA__actions__DEFAULT_ACTIONS_URL=github -> resolve `uses: <org>/<action>@ref` (e.g.
+#     actions/checkout) from github.com. The cluster HAS internet egress (LE/Cloudflare/ghcr already
+#     in use), so github-sourced actions work. A fully self-hosted/air-gapped value would require
+#     mirroring each action repo into this Gitea first; the cluster is not air-gapped, so `github`
+#     is the pragmatic, working choice (WS-GITOSS Phase-6 note).
 #   - A postStart lifecycle hook creates a BREAK-GLASS local admin idempotently (only if absent),
 #     so an IdP outage never locks the operator out of recovery tools (docs/15 availability caveat).
 #     All state (repos, SQLite DB, app.ini, INTERNAL_TOKEN) lands on the /data Longhorn PVC.
@@ -43,6 +52,10 @@ spec:
               value: gitea.home.keithjackson.dev
             - name: GITEA__server__ROOT_URL
               value: https://gitea.home.keithjackson.dev/
+            - name: GITEA__actions__ENABLED
+              value: "true"
+            - name: GITEA__actions__DEFAULT_ACTIONS_URL
+              value: github
             - name: GITEA_ADMIN_USERNAME
               valueFrom:
                 secretKeyRef: