Move CI to Gitea Actions; this project is hosted on Gitea, not GitHub

Per explicit direction: this repository is not going on GitHub. Moved
.github/workflows/ci.yml to .gitea/workflows/ci.yml (Gitea Actions'
convention) and updated every doc that referenced the old path or assumed
GitHub-specific features:

- .gitea/workflows/ci.yml: added a header comment on the two things that
  are genuinely Gitea-specific and instance-dependent, not just a renamed
  file -- `runs-on: ubuntu-latest` must match a label the actual
  registered Gitea runner advertises (there is no GitHub-hosted-runner
  equivalent, this is self-hosted), and `actions/checkout@v4` resolves
  against whatever action source that runner is configured with.
- CONTRIBUTING.md: corrected a claim that no longer holds -- it previously
  said CI "runs on a normal, unrestricted GitHub Actions VM where TSan is
  expected to work"; since this is actually a self-hosted Gitea runner
  whose environment isn't controlled by this repo, that assumption isn't
  something this repo can vouch for, so the text now says so rather than
  carrying the old (GitHub-shaped) assumption forward silently.
- SECURITY.md: removed a claim this project can't back up (that "private
  security advisories" are available once hosted -- that's a GitHub
  feature this repo never had access to); reporting is by direct email to
  the maintainer only.
- README.md: fixed a real gap while in here -- the "Security" section
  never actually linked to SECURITY.md despite it existing since the
  previous commit.
- CLAUDE.md, CHANGELOG.md: updated path references; CLAUDE.md's
  self-evaluation section (a historical record of an audit finding) keeps
  the old .github path where it describes what was literally true at that
  time, with a note explaining the rename, rather than rewriting history.

Verified: clean make all + make test, all 6 binaries pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB

CONTRIBUTING.md

@@ -19,7 +19,7 @@ project is written in.
 
 ```sh
 make test                              # must pass before any PR
-cc ... -fsanitize=address,undefined    # ASan/UBSan: see .github/workflows/ci.yml for exact flags
+cc ... -fsanitize=address,undefined    # ASan/UBSan: see .gitea/workflows/ci.yml for exact flags
 cc ... -fsanitize=thread               # TSan, for anything touching src/upper.c, src/overlay.c, or src/vfs.c
 ```
 
@@ -41,10 +41,15 @@ it or claiming verification that didn't happen — ASan/UBSan still catch
 real bugs (they found and fixed a genuine heap-use-after-free during this
 project's development, see the `reclaim_gate` note in `internal.h`) but do
 not do TSan's happens-before race analysis, so they are not a substitute
-for it. CI (`.github/workflows/ci.yml`) runs on a normal, unrestricted
-GitHub Actions VM where TSan is expected to work; treat a change as
-TSan-verified only once it has actually passed there or on a local machine
-that can run it, not merely because ASan/UBSan passed.
+for it. CI (`.gitea/workflows/ci.yml`, Gitea Actions — this project is
+hosted on Gitea, not GitHub) runs on this project's own self-hosted
+runner; whether that runner can execute TSan depends on that runner's own
+environment, which is not controlled by this repository the way a
+hosted-runner VM would be — do not assume CI's TSan step passing means
+what it would on an unrestricted machine without having actually checked
+what environment the registered runner provides. Treat a change as
+TSan-verified only once it has actually passed on a machine confirmed able
+to run it, not merely because a CI step reported success.
 
 **A second, separate environment quirk, also observed directly rather than
 assumed:** in the same kind of sandboxed environment, an ASan/UBSan-built