fix(forgejo): enable Actions globally so workflow runs are created

Every workflow in the cluster has been silently dead. app.ini carried no
[actions] section, so Forgejo never created a run: the API returns
total_count: 0 for rock/homelab and rock/homelab-frontend alike, despite both
repos reporting has_actions: true, cluster-ci.yaml and build.yaml sitting on
their default branches, and forgejo-runner having registered successfully.

Registration does not go through the dispatcher, which is why the runner looks
healthy -- it logs "declared successfully" and "[poller 0] launched" and then
picks up nothing, forever. That reads like a runner or label problem and is
neither.

This also explains why the api-gateway images in the registry were all built
by hand: the pipeline that was supposed to build them has never once run.

Forgejo restarts on this values change; git and the container registry are
briefly unavailable.

k8s/bootstrap/phase3-forgejo/forgejo-values.yaml

@@ -64,6 +64,22 @@ gitea:
       TYPE: redis
       CONN_STR: redis://forgejo-redis.cicd.svc.cluster.local:6379/2
 
+    # Actions must be enabled globally, not just per-repo. Without this section
+    # app.ini carries no [actions] block at all and Forgejo never *creates* a
+    # workflow run — the API returns total_count: 0 for every repo even though
+    # each repo reports has_actions: true, the workflow file is on the default
+    # branch, and forgejo-runner has registered successfully with label
+    # [docker]. Registration does not require the dispatcher, so a healthy-
+    # looking runner sitting at "[poller 0] launched" with zero task pickups is
+    # the symptom of this being off, not of a bad workflow or a label mismatch.
+    #
+    # DEFAULT_ACTIONS_URL is left at its default (https://code.forgejo.org),
+    # which is where `uses: actions/checkout@v4` and friends resolve from. That
+    # requires egress from the runner; if it is ever blocked, pin the actions to
+    # local copies rather than turning this off.
+    actions:
+      ENABLED: true
+
 # Persistence (shared storage for repos)
 persistence:
   enabled: true