feat: Gitea Actions compatibility test suite

A self-validating test suite that proves Gitea's implementations of
GitHub-style actions behave like GitHub's. Push to any Gitea instance
with a registered runner — on push or manual dispatch, it runs 10
independent test workflows covering checkout, artifacts, caching,
language setup, expression contexts, workflow commands, services,
composite/reusable workflows, control flow, and known divergences.

Components:
- lib/assert.sh — self-asserting shell helper library (assert_eq,
  assert_contains, assert_exists, assert_not_exists, assert_match,
  sha256_of) with verified negative fail path
- 10 reusable workflows (on: workflow_call):
  01-checkout, 02-artifacts, 03-cache, 04-setup-runtime,
  05-contexts, 06-workflow-commands, 07-services,
  08-composite-reusable, 09-control-flow, 10-gitea-divergences
- 00-suite-runner.yml — sole entry (on: push + workflow_dispatch):
  probe gate (Gitea >= 1.22.0) -> c1-c10 parallel callers
  (c5/c8 forward secrets: inherit for act_runner #125) ->
  aggregate (if: always, skipped-as-failure)
- Fixtures: LFS 5MB binary, git tag v1-test, 4 language lockfiles
  (npm/go/pip/maven), sparse-cone layout
- Makefile: make lint (actionlint static gate)
- README: prerequisites, per-test expectations, correction table,
  manual eyeball checklist for UI-only behaviors

.github/actionlint.yaml

@@ -0,0 +1,23 @@
+# .github/actionlint.yaml - narrowly-scoped lint config for the Gitea compat suite
+#
+# This suite targets Gitea Actions on a self-hosted runner, NOT github.com.
+# actionlint's bundled metadata marks several v3 actions (e.g. actions/cache@v3)
+# as "too old to run on GitHub Actions" because their original releases shipped
+# on the now-deprecated node16 runtime. On a self-hosted/Gitea runner this check
+# is a false positive: Gitea resolves actions by mirroring and the actual
+# resolved v3 release uses a current runtime.
+#
+# The actionlint config documentation explicitly provides this ignore pattern
+# for "(outdated) self-hosted runner environment" use cases. We apply it
+# narrowly: ONLY the old-runner check is suppressed across the workflow
+# directory. Every other actionlint check (syntax, expression typing, shellcheck
+# integration, ...) remains fully enforced.
+#
+# NOTE: actionlint auto-discovers config at .github/actionlint.yaml. The README's
+# repo-layout note mentions .github/workflows/actionlint.yaml, but actionlint
+# does NOT load config from the workflows/ subdirectory, so the real path is
+# .github/actionlint.yaml.
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - 'the runner of ".+" action is too old to run on GitHub Actions'