Move CI to Gitea Actions; this project is hosted on Gitea, not GitHub

Per explicit direction: this repository is not going on GitHub. Moved
.github/workflows/ci.yml to .gitea/workflows/ci.yml (Gitea Actions'
convention) and updated every doc that referenced the old path or assumed
GitHub-specific features:

- .gitea/workflows/ci.yml: added a header comment on the two things that
  are genuinely Gitea-specific and instance-dependent, not just a renamed
  file -- `runs-on: ubuntu-latest` must match a label the actual
  registered Gitea runner advertises (there is no GitHub-hosted-runner
  equivalent, this is self-hosted), and `actions/checkout@v4` resolves
  against whatever action source that runner is configured with.
- CONTRIBUTING.md: corrected a claim that no longer holds -- it previously
  said CI "runs on a normal, unrestricted GitHub Actions VM where TSan is
  expected to work"; since this is actually a self-hosted Gitea runner
  whose environment isn't controlled by this repo, that assumption isn't
  something this repo can vouch for, so the text now says so rather than
  carrying the old (GitHub-shaped) assumption forward silently.
- SECURITY.md: removed a claim this project can't back up (that "private
  security advisories" are available once hosted -- that's a GitHub
  feature this repo never had access to); reporting is by direct email to
  the maintainer only.
- README.md: fixed a real gap while in here -- the "Security" section
  never actually linked to SECURITY.md despite it existing since the
  previous commit.
- CLAUDE.md, CHANGELOG.md: updated path references; CLAUDE.md's
  self-evaluation section (a historical record of an audit finding) keeps
  the old .github path where it describes what was literally true at that
  time, with a note explaining the rename, rather than rewriting history.

Verified: clean make all + make test, all 6 binaries pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB

README.md

@@ -260,7 +260,7 @@ never mutates a buffer address a reader might be reading (Section 5.7):
 growth always allocates a new buffer and publishes it, never reallocates in
 place. `tests/test_concurrency.c` exercises this under concurrent reader and
 writer threads, and the suite is regularly run under ThreadSanitizer and
-AddressSanitizer (see `.github/workflows/ci.yml`).
+AddressSanitizer (see `.gitea/workflows/ci.yml`).
 
 ## Security
 
@@ -274,7 +274,9 @@ silently assumed equivalent. Pack files are treated as untrusted input unless
 they came from this process's own compaction: every on-disk offset is
 bounds-checked and the pack's checksum is verified before any of it is
 trusted (Section 7). See `tests/test_dir.c` for a containment regression test
-and `tests/test_pack_overlay.c` for a corrupted-pack rejection test.
+and `tests/test_pack_overlay.c` for a corrupted-pack rejection test. See
+[`SECURITY.md`](SECURITY.md) for exactly what is and isn't claimed as a
+security boundary, and how to report a vulnerability.
 
 ## Contributing