feat: Gitea Actions compatibility test suite

A self-validating test suite that proves Gitea's implementations of
GitHub-style actions behave like GitHub's. Push to any Gitea instance
with a registered runner — on push or manual dispatch, it runs 10
independent test workflows covering checkout, artifacts, caching,
language setup, expression contexts, workflow commands, services,
composite/reusable workflows, control flow, and known divergences.

Components:
- lib/assert.sh — self-asserting shell helper library (assert_eq,
  assert_contains, assert_exists, assert_not_exists, assert_match,
  sha256_of) with verified negative fail path
- 10 reusable workflows (on: workflow_call):
  01-checkout, 02-artifacts, 03-cache, 04-setup-runtime,
  05-contexts, 06-workflow-commands, 07-services,
  08-composite-reusable, 09-control-flow, 10-gitea-divergences
- 00-suite-runner.yml — sole entry (on: push + workflow_dispatch):
  probe gate (Gitea >= 1.22.0) -> c1-c10 parallel callers
  (c5/c8 forward secrets: inherit for act_runner #125) ->
  aggregate (if: always, skipped-as-failure)
- Fixtures: LFS 5MB binary, git tag v1-test, 4 language lockfiles
  (npm/go/pip/maven), sparse-cone layout
- Makefile: make lint (actionlint static gate)
- README: prerequisites, per-test expectations, correction table,
  manual eyeball checklist for UI-only behaviors

.github/workflows/01-checkout.yml

@@ -0,0 +1,157 @@
+---
+name: Checkout Variants (C1)
+
+# Reusable workflow invoked by caller job c1 in 00-suite-runner.yml.
+# Probes actions/checkout@v4 across its input matrix: default, fetch-depth,
+# lfs, ref (tag), path, sparse-checkout cone mode, persist-credentials
+# (true/false, with a non-vacuous assertion that the embedded credential
+# token differs between the two), and an optional submodule checkout gated
+# on a workflow_call input. on: workflow_call ONLY (no push/pull_request).
+
+on:
+  workflow_call:
+    inputs:
+      usesubmodule:
+        description: Set to "true" to enable the submodule checkout test.
+        required: false
+        type: string
+        default: 'false'
+
+jobs:
+  checkout-variants:
+    runs-on: ubuntu-24.04
+    steps:
+      # --- default checkout: get repo + assert library ---
+      - name: checkout-default
+        uses: actions/checkout@v4
+
+      - name: default-assert
+        run: |
+          source lib/assert.sh
+          cp lib/assert.sh "$RUNNER_TEMP/assert.sh"
+          assert_exists lib/assert.sh
+
+      # --- fetch-depth: 0 (full history) ---
+      - name: checkout-full-history
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: full-history-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          count=$(git rev-list --count HEAD)
+          is_gt1=false
+          if [ "$count" -ge 1 ]; then is_gt1=true; fi
+          assert_eq "$is_gt1" true "fetch-depth:0 sees full history ($count commits, >=1)"
+
+      # --- lfs: true (conditional on git lfs availability) ---
+      - name: checkout-lfs
+        uses: actions/checkout@v4
+        with:
+          lfs: true
+
+      - name: lfs-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          if ! git lfs version >/dev/null 2>&1; then
+            echo "SKIP: git lfs not available (documented skip)"
+          else
+            assert_exists test.bin
+            actual=$(sha256_of test.bin)
+            expected=$(cat fixtures/test.bin.sha256)
+            assert_eq "$actual" "$expected" "lfs smudged content sha256 matches fixture"
+          fi
+
+      # --- ref: v1-test (checkout a tag) ---
+      # $RUNNER_TEMP/assert.sh copy is essential here: commit 36469e7 (v1-test)
+      # predates lib/assert.sh, so the file is absent at this ref.
+      - name: checkout-ref-tag
+        uses: actions/checkout@v4
+        with:
+          ref: v1-test
+
+      - name: ref-tag-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          tag=$(git describe --tags --exact-match 2>/dev/null)
+          assert_eq "$tag" v1-test "checked out tag is v1-test"
+
+      # --- path: sub (checkout into a subdirectory) ---
+      - name: checkout-path-sub
+        uses: actions/checkout@v4
+        with:
+          path: sub
+
+      - name: path-sub-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          assert_exists sub/test.bin
+
+      # --- sparse-checkout cone mode ---
+      - name: checkout-sparse-cone
+        uses: actions/checkout@v4
+        with:
+          sparse-checkout: |
+            sparse-cone/keep
+          sparse-checkout-cone-mode: true
+
+      - name: sparse-cone-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          assert_exists sparse-cone/keep/marker
+          assert_not_exists sparse-cone/skip/marker
+
+      # --- persist-credentials: true (separate path to avoid interference) ---
+      - name: checkout-persist-true
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: true
+          path: pc-true
+
+      - name: persist-true-capture
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          url=$(git -C pc-true config --local remote.origin.url)
+          printf '%s\n' "$url" > "$RUNNER_TEMP/url_true.txt"
+
+      # --- persist-credentials: false (separate path) ---
+      - name: checkout-persist-false
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          path: pc-false
+
+      - name: persist-credentials-assert
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          url_true=$(cat "$RUNNER_TEMP/url_true.txt")
+          url_false=$(git -C pc-false config --local remote.origin.url)
+          # Non-vacuous: true embeds a credential segment (scheme://user:token@host), false does not
+          tok_true=false
+          if [[ "$url_true" == *"://"*":"*"@"* ]]; then tok_true=true; fi
+          assert_eq "$tok_true" true "persist-credentials:true embeds credential in remote.origin.url"
+          tok_false=false
+          if [[ "$url_false" == *"://"*":"*"@"* ]]; then tok_false=true; fi
+          assert_eq "$tok_false" false "persist-credentials:false does NOT embed credential"
+          differ=false
+          if [ "$url_true" != "$url_false" ]; then differ=true; fi
+          assert_eq "$differ" true "persist-credentials true/false URLs differ (non-vacuous)"
+
+      # --- submodule (conditional on input) ---
+      - name: checkout-submodule
+        if: inputs.usesubmodule == 'true'
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: submodule-assert
+        if: inputs.usesubmodule == 'true'
+        run: |
+          source "$RUNNER_TEMP/assert.sh"
+          assert_exists lib/assert.sh
+
+      - name: submodule-skip
+        if: inputs.usesubmodule != 'true'
+        run: |
+          echo "SKIP: submodule test is conditional (set workflow_call input usesubmodule=true to enable)"