ci: target Gitea Ubuntu and native Apple Silicon runners

Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.

docs/continuation.md

@@ -73,5 +73,7 @@ validation must happen on macOS with Xcode and real supported devices.
 5. Establish private vulnerability reporting, owned identifiers, authorized CI,
    human security review and owner-controlled signing before any distribution.
 
-The provided GitHub Actions workflows do not automatically execute on the current
-non-GitHub forge. Do not claim hosted CI or store readiness without actual runs.
+Gitea workflows in `.gitea/workflows/` target the maintainer's `ubuntu-latest`
+pool and `macos-arm64` M4 Pro runner. Read [runner setup](ci-runners.md) before
+changing their labels or signing policy. Hosted CI and store readiness still
+require actual successful runs; runner registration alone is not test evidence.