feat: Gitea Actions compatibility test suite

A self-validating test suite that proves Gitea's implementations of
GitHub-style actions behave like GitHub's. Push to any Gitea instance
with a registered runner — on push or manual dispatch, it runs 10
independent test workflows covering checkout, artifacts, caching,
language setup, expression contexts, workflow commands, services,
composite/reusable workflows, control flow, and known divergences.

Components:
- lib/assert.sh — self-asserting shell helper library (assert_eq,
  assert_contains, assert_exists, assert_not_exists, assert_match,
  sha256_of) with verified negative fail path
- 10 reusable workflows (on: workflow_call):
  01-checkout, 02-artifacts, 03-cache, 04-setup-runtime,
  05-contexts, 06-workflow-commands, 07-services,
  08-composite-reusable, 09-control-flow, 10-gitea-divergences
- 00-suite-runner.yml — sole entry (on: push + workflow_dispatch):
  probe gate (Gitea >= 1.22.0) -> c1-c10 parallel callers
  (c5/c8 forward secrets: inherit for act_runner #125) ->
  aggregate (if: always, skipped-as-failure)
- Fixtures: LFS 5MB binary, git tag v1-test, 4 language lockfiles
  (npm/go/pip/maven), sparse-cone layout
- Makefile: make lint (actionlint static gate)
- README: prerequisites, per-test expectations, correction table,
  manual eyeball checklist for UI-only behaviors

.github/workflows/09-control-flow.yml

@@ -0,0 +1,72 @@
+# C9 - control-flow: timeout-minutes, continue-on-error, concurrency (parse-only)
+# Reusable workflow invoked by 00-suite-runner.yml. Verifies three control-flow
+# behaviors:
+#   1. timeout-minutes kills a runaway job (asserted from a dependent job, since
+#      a dead job cannot assert its own death).
+#   2. continue-on-error makes a job report success to dependents despite a
+#      tolerated step failure.
+#   3. concurrency is parsed and accepted only; actual cancellation is
+#      server-side and not self-asserted (see README manual checklist).
+name: 09-control-flow
+
+on:
+  workflow_call:
+
+# concurrency: parse-and-accept only. Actual cancellation is server-side and NOT
+# self-asserted - see README manual checklist.
+concurrency:
+  group: cf-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Sleeps past its timeout-minutes limit. The runner kills it, so the job's
+  # result is NOT 'success' (exact string is version-dependent: 'failure' or
+  # 'cancelled'). The slow-check dependent job asserts the non-success result.
+  slow:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 1
+    steps:
+      - name: sleep past the timeout limit
+        run: sleep 90
+
+  # Dependent assertion: MUST use if: always() so it runs despite 'slow' failing.
+  # Asserts != 'success' (NOT == 'failure') because the timed-out result string
+  # is version-dependent.
+  slow-check:
+    needs: slow
+    if: always()
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: assert slow was killed by timeout
+        shell: bash
+        run: |
+          source lib/assert.sh
+          if [ "${{ needs.slow.result }}" != "success" ]; then
+            assert_eq "killed" "killed" "slow was killed by timeout (result: ${{ needs.slow.result }})"
+          else
+            assert_eq "should-have-failed" "did-not-fail" "slow unexpectedly succeeded"
+          fi
+
+  # A failing step guarded by continue-on-error: true. The job reports success to
+  # dependents despite the tolerated failure.
+  flaky:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: tolerated failure
+        continue-on-error: true
+        run: exit 1
+
+  # Dependent assertion: MUST use if: always(). Asserts the flaky job reports
+  # 'success' to dependents because the failing step was tolerated.
+  flaky-check:
+    needs: flaky
+    if: always()
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: assert continue-on-error reports success to dependents
+        shell: bash
+        run: |
+          source lib/assert.sh
+          assert_eq "${{ needs.flaky.result }}" "success" "continue-on-error: job reports success to dependents"