ci: target Gitea Ubuntu and native Apple Silicon runners

Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.

scripts/check-ci-runner.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Validate prerequisites without installing packages or modifying the runner host.
+set -euo pipefail
+
+fail() { printf 'Runner prerequisite: %s\n' "$*" >&2; exit 1; }
+for tool in git curl unzip python3; do
+  command -v "$tool" >/dev/null || fail "install $tool in the job environment"
+done
+
+case "${1:-}" in
+  android|emulator)
+    [[ "$(uname -s)" == Linux && "$(uname -m)" == x86_64 ]] || fail 'ubuntu-latest must provide Linux x86_64'
+    if [[ "$1" == emulator ]]; then
+      [[ -c /dev/kvm && -r /dev/kvm && -w /dev/kvm ]] || fail 'expose /dev/kvm to the job and grant the runner user read/write access (nested virtualization required on VMs)'
+    fi
+    ;;
+  ios)
+    [[ "$(uname -s)" == Darwin && "$(uname -m)" == arm64 ]] || fail 'macos-arm64 must execute natively on the Apple Silicon host'
+    command -v xcodebuild >/dev/null || fail 'install full Xcode and select it with xcode-select'
+    xcodebuild -version
+    xcrun --find swift >/dev/null
+    xcrun simctl list devices available >/dev/null
+    ;;
+  *) fail 'usage: bash scripts/check-ci-runner.sh android|emulator|ios' ;;
+esac