Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate

STEP 1 — enable Gitea Actions: pin GITEA__actions__ENABLED=true and
DEFAULT_ACTIONS_URL=github in the gitea bootstrap patch (was implicit upstream
default; make it a declared property).

STEP 2 — deploy + register an act_runner in a dedicated non-app namespace
(gitea-actions) so the privileged DinD executor sidecar is admitted without a
Kyverno policy exception (restrict-host-namespaces scopes to app namespaces only).
Docker executor + DinD sidecar over a shared TLS-cert emptyDir; runner state on a
Longhorn PVC (registers once). Registration token delivered as a SOPS-encrypted
Secret decrypted by Flux. Runner mounts no ServiceAccount token (R-SEC-02).

STEP 3 — author .gitea/workflows/gate.yml: the live enforced merge gate running
the STATIC layers (spec-immutability best-effort, lint, Kyverno L0, L1 render) via
`make -C ci lint l0 l1` with the pinned toolchain installed at job start. L2/L3
conformance is an if:false placeholder (needs a toolchain image + scoped cluster
creds — a design decision, not wired). merge-gate.yaml reduced to workflow_dispatch
(dormant full-pipeline blueprint). install-tools.sh gains check-jsonschema so the
schema stage validates in CI instead of skipping.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/kustomization.yaml

@@ -9,6 +9,8 @@ resources:
   - pihole.yaml
   - gitea.yaml
   - gitea-bootstrap-secret.sops.yaml   # SOPS: fixed SECRET_KEY + break-glass admin creds (decrypted by Flux)
+  - gitea-actions.yaml                 # Phase 6 CI/CD: in-cluster act_runner (ns gitea-actions) + DinD
+  - gitea-actions-runner-secret.sops.yaml  # SOPS: act_runner registration token (decrypted by Flux)
   - sonarr.yaml
   - radarr.yaml
   - plex.yaml