Parse the workflows on Gitea too, and keep the compat matrix off its runner

Both found by the subscriptions session in its copy of this kit, and both
reproduce here. They share the shape everything else in ci/ has had: the
failure is invisible on GitHub, which is where anyone would be looking.

1. ci/workflows-in-sync.sh never parsed the workflow files on Gitea, and
   printed "Workflows: in sync." anyway. It skipped with a note when PyYAML was
   missing — and PyYAML is missing in exactly one place. Measured here rather
   than taken on report: `import yaml` on gitea/runner-images:ubuntu-latest
   raises ModuleNotFoundError. So the check was switched off on the single
   forge where an unparseable workflow produces no run at all, no failed run
   and no error to click on, which looks exactly like a runner that has not
   picked the job up.

   ci_python_yaml in ci/lib.sh now falls back to a container the way ci_php
   already did — alpine + py3-yaml, no network install, one apk call. There is
   no skip path left: workflows that cannot be parsed are a failure, not a
   note. Both routes verified to give byte-identical output.

2. compat.yml ran its five-cell matrix on Gitea for every PR touching ci/ or
   tests/. The `schedule` was gated to GitHub for exactly this reason and
   `pull_request` was forgotten. The subscriptions repo measured six jobs dying
   together with exit code 137 — SIGKILL, runner out of memory, two seconds in,
   without one error message in the log. Latent here only because this repo
   merges through GitHub and never opens a Gitea PR; one Gitea PR touching ci/
   would have found it.

New ci/check-workflows.py enforces both, called through ci_python_yaml. It
parses every workflow and fails when a Gitea job with more than one matrix cell
is not gated, and it is fatal when it parsed no file at all.

🔴 Its first version asked whether the `if:` CONTAINED the server_url test, and
passed the very condition it exists to catch: `!= 'schedule' || server_url ==
...` contains the gate while letting pull_request through. Substring matching is
adjacent to the signal rather than the signal. It now compares the whole
normalised condition against an allowlist, and was checked both ways in one run
— red against the unfixed compat.yml naming the job and the cell count, green
after.

Three self-test assertions added, 29 total: an unparseable workflow fails, an
ungated multi-cell matrix fails, and parsing zero files fails.

Two notes from building it, both the same trap this kit keeps setting. The
container path could not find check-workflows.py because ci_in_container tars
`git ls-files` and the file was untracked. And the ungated-matrix fixture used
| as a sed delimiter while the gate itself contains ||, so sed silently changed
nothing; the assertion reported "could not stage the fixture" instead of
passing, which is the only reason it was noticed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ci/selftest.sh

@@ -178,6 +178,53 @@ else
   ok "a plugin.conf with no floors fails to load"
 fi
 
+# ------------------------------------------------------------------ workflows
+# Both of these are silent where they happen. An unparseable workflow produces
+# NO RUN on Gitea, and a multi-cell matrix that is not gated lands on one
+# self-hosted runner as exit code 137 with an empty log. Neither shows up on
+# GitHub, which is where anyone would be looking.
+echo
+echo "→ ci/workflows-in-sync.sh must catch what only breaks on Gitea"
+cd "$work/repo"
+cp -a .github/workflows "$work/wf-github-backup"
+cp -a .gitea/workflows  "$work/wf-gitea-backup"
+restore_workflows() {
+  rm -rf .github/workflows .gitea/workflows
+  cp -a "$work/wf-github-backup" .github/workflows
+  cp -a "$work/wf-gitea-backup"  .gitea/workflows
+}
+
+# Corrupt BOTH roots identically, so this fails on the PARSE rather than on the
+# byte-identity rule that would otherwise fire first.
+printf '\n  this: [is not\n' >> .github/workflows/ci.yml
+printf '\n  this: [is not\n' >> .gitea/workflows/ci.yml
+./ci/workflows-in-sync.sh >/dev/null 2>&1 \
+  && bad "an unparseable workflow passed — on Gitea it would simply never run" \
+  || ok "an unparseable workflow fails the build"
+restore_workflows
+
+# The gate that keeps a five-cell matrix off the single self-hosted runner.
+# @ as the delimiter, not |: the gate itself contains `||`, and with | as the
+# delimiter sed parses the fixture into nonsense and silently changes nothing —
+# which is how this assertion first ran against an unmodified file. It reported
+# "could not stage the fixture" rather than passing, which is the whole reason
+# the staging is checked before the assertion is made.
+sed -i "s@^    if: github.event_name == 'workflow_dispatch'.*@    if: always()@" \
+  .github/workflows/compat.yml .gitea/workflows/compat.yml
+if grep -q 'if: always()' .gitea/workflows/compat.yml; then
+  ./ci/workflows-in-sync.sh >/dev/null 2>&1 \
+    && bad "an ungated multi-cell matrix passed — it lands on the Gitea runner as exit 137" \
+    || ok "an ungated multi-cell matrix fails the build"
+else
+  bad "could not stage the ungated-matrix fixture — the gate line did not match"
+fi
+restore_workflows
+
+# Parsing nothing is never a legitimate result.
+ci_python_yaml ci/check-workflows.py >/dev/null 2>&1 \
+  && bad "check-workflows.py passed having parsed no file at all" \
+  || ok "parsing zero workflow files is fatal"
+
 echo
 if [ "$fail" != 0 ]; then
   echo "Self-test: $fail of $((pass + fail)) assertions FAILED."