fix: move workflows from .forgejo/workflows to .gitea/workflows

.forgejo/workflows/*.yaml never creates an action_run on push on this
Forgejo instance (1.27.0) -- confirmed directly in the action_run table
across multiple probe pushes. .gitea/workflows fires immediately with an
identical spec. This is why build.yaml never once executed.

.forgejo/workflows/probe.yml

@@ -1,9 +0,0 @@
-name: Probe
-on:
-  push:
-    branches: [main]
-jobs:
-  noop:
-    runs-on: docker
-    steps:
-      - run: echo hi

.gitea/workflows/ci.yaml

@@ -1,6 +1,17 @@
 # Forgejo Actions CI — verification only (vet, test, build).
 # Build and push happens in build.yaml on main push.
-# Note: Forgejo reads .forgejo/workflows/, not .github/workflows/.
+#
+# Path is .gitea/workflows/, not .forgejo/workflows/ or .github/workflows/.
+# Verified live against this instance (Forgejo 1.27.0, forgejo.riotpiao.com)
+# on 2026-08-21: a .forgejo/workflows/*.yaml file never creates an action_run
+# row on push, not once, for any repo -- confirmed both from application logs
+# (silent, no error) and directly in the action_run table. A .gitea/workflows
+# file with an identical job spec fires immediately. .github/workflows also
+# gets scanned (that's how the old, dead ubuntu-latest CI on this repo and on
+# kmsvc-manage both got action_run rows despite matching no runner) -- so
+# .forgejo/workflows/ specifically appears unsupported on this instance/version,
+# not workflow detection being off in general.
+#
 # runs-on: docker matches the only label the cluster runner declares.
 name: CI
 

.gitea/workflows/probe-gitea.yml

@@ -1,9 +0,0 @@
-name: ProbeGitea
-on:
-  push:
-    branches: [main]
-jobs:
-  noop:
-    runs-on: docker
-    steps:
-      - run: echo hi