fix(ci): rename .forgejo to .gitea, use golang runner with docker container

docs/adr/ADR-0001-atlas-cluster-visualization.md

@@ -33,7 +33,7 @@ Goal: replace fabricated claims with a live, interactive, public view of the rea
 **GitOps**
 
 - `homelab-root` is an app-of-apps: 31 child `Application` resources
-- Source: `[email protected]:Riotpiaole/riotpiao.homelab.com.git`, path `k8s/argocd/apps`
+- Source: `[email protected]:Riotpiaole/riotpiao.com.git`, path `k8s/argocd/apps`
 - Sync waves **0 → 8** already annotated across apps
 - ~550 managed resources total (largest: `prometheus` 68, `cert-manager` 47, `kong` 39)
 
@@ -273,7 +273,7 @@ Surface E precedes C and D deliberately: it reuses Phase 1 data wholesale and is
 
 **Open questions requiring an answer before Phase 1**
 
-1. **Two GitOps roots exist.** `homelab-root` reads `[email protected]:Riotpiaole/riotpiao.homelab.com.git`. This repo's `infra/argocd-apps.yaml` points at `forgejo.riotpiao.homelab.com` — a hostname that does not resolve — and its `portfolio` and `auth-infra` Applications **do not exist in the cluster**. Which repository is authoritative for the portfolio?
+1. **Two GitOps roots exist.** `homelab-root` reads `[email protected]:Riotpiaole/riotpiao.com.git`. This repo's `infra/argocd-apps.yaml` points at `forgejo.riotpiao.com` — a hostname that does not resolve — and its `portfolio` and `auth-infra` Applications **do not exist in the cluster**. Which repository is authoritative for the portfolio?
 2. **Apex returns 403 from the Cloudflare edge.** Is this an absent tunnel public-hostname route, a WAF rule, or a proxied record with no origin? The portfolio cannot ship until this is understood.
 3. Is `homarr` still wanted? It is deployed and healthy, but the plan it came from is abandoned.
 4. Does the chat surface stay in scope given the 8-slot ceiling, or ship topology + delivery + terminal first and treat chat as a separate decision?