ci: target Gitea Ubuntu and native Apple Silicon runners

Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.

docs/validation.md

@@ -121,10 +121,23 @@ is available; no iOS build/archive/UI result is claimed.
   Also run minimum-supported API 26 and a current OS/WebView device matrix.
 - VoiceOver/TalkBack, large text, contrast, keyboard/safe areas, reduced motion,
   light/dark appearance and responsive web modules on actual supported devices.
-- Operational CI runs on an authorized GitHub repository/runner, private security
+- Successful CI runs on the configured Gitea runners, private security
   reporting contact, human security review, store ownership and production signing.
 
 No Firebase/APNs registration, closed-app push, offline editing, App Store approval,
 signing, publication or physical-device validation is claimed. See `SECURITY.md`
 and `docs/security-review.md` for residual limitations.
 Resume work using [maintainer continuation](continuation.md).
+
+## Gitea runner adaptation
+
+Workflows now live in `.gitea/workflows/` and target the supplied `ubuntu-latest`
+pool and native `macos-arm64` M4 Pro runner. Local workflow grammar lint (Gitea URL
+syntax normalized), repository invariants, shell/Python syntax, ten mocked runner
+preflight regressions and eight evidence-verifier regressions pass. SHA-256 Git
+initialization/fetch was exercised locally; the pinned XcodeGen archive's checksum
+and native arm64 slice were verified. These are not remote runner execution or
+Apple SDK results. See [runner requirements](ci-runners.md); the local emulator
+preflight currently rejects unavailable/inaccessible KVM as designed. Original
+application build evidence above remains historical and is not a rebuild of the
+workflow-only changes.