ci: qualify forge stack through Woodpecker + Dagger

[dporkka]

Purpose

Validation-only convergence PR for the complete hardened forge/Gitea stack (#149-#153) plus the isolated Woodpecker + Dagger CI substrate (#156).

Do not merge this PR as a flattening shortcut. Its job is to prove the exact combined source state before the feature stack is merged in order.

Exact ancestry

The current head explicitly descends from:

• hardened Gitea endpoint stack feat(webhooks): add signed Gitea ingress endpoint #153 (feat/gitea-webhook-endpoint-v1);
• hardened CI substrate ci: make Woodpecker + Dagger the portable validation lane #156 (ci/woodpecker-dagger-v1).

The combined tree therefore includes the same forge security and CI files that will be merged separately.

Security properties under qualification

Forge publication now requires:

1. persisted repository provider;
2. canonical forge instance authority;
3. exact workspace origin scheme/host/port/repository path;
4. only then may Git push credentials be attached;
5. Gitea signed malformed webhook payloads fail closed and specific X-Gitea-Event-Type semantics are preserved.

The CI lane now requires:

• exact CI_COMMIT_SHA checkout;
• no PR access to /var/run/docker.sock;
• operator-injected _EXPERIMENTAL_DAGGER_RUNNER_HOST;
• Dagger CLI v0.20.3 SHA-256 verification;
• Go 1.26.8 archive SHA-256 verification;
• committed-range git diff --check;
• repository-native lint/test/build gates through Dagger.

Execution architecture

GitHub webhook
  -> Woodpecker
  -> unprivileged Dev Plane job container
  -> tcp://dagger-engine:1234
  -> operator-owned privileged Dagger Engine on dedicated CI host

Nulang Cloud #826 (repository activation/repair) and #827 (operator-owned Dagger Engine/private execution network) are merged.

Remaining operational dependency

The merged Nulang Cloud control-plane source must be reconciled on the dedicated CI host, then dporkka/dev-plane must be activated/repaired in Woodpecker with the operator-only administrator PAT. Those privileged operator actions are intentionally not represented by repository credentials.

After that, a synchronize event on this PR should create a Woodpecker status for this exact combined head. A result counts only if Dagger actually executes the repository checks; zero-step GitHub-hosted Actions failures remain non-authoritative infrastructure evidence.

Merge policy

Once qualification is green, merge the actual stack in order (#149 -> #150 -> #151 -> #152 -> #153) and merge #156 independently as the CI substrate. Close this validation PR afterward.

[dporkka]

CI qualification update (2026-10-05): the Woodpecker+Dagger infrastructure from this combined forge validation branch has been extracted into clean CI-only PR #156 (3 additive files on main). Keep this PR as the full #149-#153 forge/Gitea exact-stack probe; do not merge it as a flattening shortcut.

Current blocker classification is now strong:

• this PR produced the expected GitHub Actions zero-step / runner_id=0 failure;
• no Woodpecker status context appeared at all, so Dagger/agent execution has not been reached;
• Nulang Cloud's Woodpecker control plane is alive, and #826's new repository activation helper has passed its real ci/woodpecker/pr/control-plane lane on bootstrap-ci after a PR synchronize event.

Next gate: operator activates/repairs dporkka/dev-plane in Woodpecker using Nulang Cloud #826's ensure-repository.sh, then advance this branch with a no-source-change commit and require a Woodpecker context on that exact head. If it is pending, diagnose scheduling; if it fails, inspect Dagger logs; only a real terminal success counts as source evidence.