Move CI to Gitea Actions; this project is hosted on Gitea, not GitHub

Per explicit direction: this repository is not going on GitHub. Moved
.github/workflows/ci.yml to .gitea/workflows/ci.yml (Gitea Actions'
convention) and updated every doc that referenced the old path or assumed
GitHub-specific features:

- .gitea/workflows/ci.yml: added a header comment on the two things that
  are genuinely Gitea-specific and instance-dependent, not just a renamed
  file -- `runs-on: ubuntu-latest` must match a label the actual
  registered Gitea runner advertises (there is no GitHub-hosted-runner
  equivalent, this is self-hosted), and `actions/checkout@v4` resolves
  against whatever action source that runner is configured with.
- CONTRIBUTING.md: corrected a claim that no longer holds -- it previously
  said CI "runs on a normal, unrestricted GitHub Actions VM where TSan is
  expected to work"; since this is actually a self-hosted Gitea runner
  whose environment isn't controlled by this repo, that assumption isn't
  something this repo can vouch for, so the text now says so rather than
  carrying the old (GitHub-shaped) assumption forward silently.
- SECURITY.md: removed a claim this project can't back up (that "private
  security advisories" are available once hosted -- that's a GitHub
  feature this repo never had access to); reporting is by direct email to
  the maintainer only.
- README.md: fixed a real gap while in here -- the "Security" section
  never actually linked to SECURITY.md despite it existing since the
  previous commit.
- CLAUDE.md, CHANGELOG.md: updated path references; CLAUDE.md's
  self-evaluation section (a historical record of an audit finding) keeps
  the old .github path where it describes what was literally true at that
  time, with a note explaining the rename, rather than rewriting history.

Verified: clean make all + make test, all 6 binaries pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqJpkdJ6Njnt1pw3CbghzB

SECURITY.md

@@ -61,10 +61,10 @@ known limitations, not silent gaps:
 
 ## Reporting a vulnerability
 
-Please do not open a public GitHub issue for a suspected security
-vulnerability. Once this repository has a hosting remote and private
-security advisories are available there, prefer that. Until then, or as an
-alternative, report privately to the maintainer:
+This project is hosted on Gitea, not GitHub (see `CONTRIBUTING.md`).
+Please do not open a public issue on the issue tracker for a suspected
+security vulnerability — report it privately, by email, to the
+maintainer:
 
 **retoor** — `retoor@molodetz.nl`
 
@@ -82,5 +82,5 @@ to pass under `-fsanitize=address,undefined` and `-fsanitize=thread`
 before being considered done (`CLAUDE.md`) — this process has already
 caught and fixed a real heap-use-after-free in the snapshot-reclamation
 logic during development (see the `reclaim_gate` note in `src/internal.h`).
-`.github/workflows/ci.yml` runs the full test suite plus both sanitizer
-passes on every push.
+`.gitea/workflows/ci.yml` (Gitea Actions) runs the full test suite plus
+both sanitizer passes on every push.