feat(ci): checks-on-push workflow (Forgejo Actions, eval tier)

.forgejo/workflows/check.yml runs on every push to main/v1 (+ manual
dispatch): nix flake check --no-build (full module-system eval incl.
the downstream template through mkFlake), py_compile of
nomarchy-theme-sync, and bash -n over tracked .sh files. The always-on
net under direct-to-main pushes — first slice of the ROADMAP lock-bump
CI item.

Scoped to the eval tier deliberately: the instance's runner is an
act_runner docker container (no systemd, no /dev/kvm — established
from the legacy repo's .gitea/workflows/check.yml, which ran 57 times
on it), so the checks.* VM suite and real builds can't run there. A
commented vm-checks job documents the KVM-runner upgrade path; the
legacy workflow's container gotchas (nixbld setup for the single-user
installer, sandbox=false for Stylix IFD, Nix pinned 2.31.5 vs
lazy-trees, no JS actions past node20) are carried over verbatim in
the header. docs/TESTING.md §1b documents what a green run does and
does not mean.

Verified: V0 locally (the same check commands, minus the container
Nix install) + YAML parse. A real green run depends on the runner
still being registered — not API-visible unauthenticated, so that is
queued as [human] BACKLOG item 20.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -22,20 +22,16 @@ next, in what order*.
 
 ## NOW
 
-### 2. CI: run the check suite on every push (Forgejo Actions)
-First slice of ROADMAP § Automated upstream lock bumps, promoted to NOW
-because agents now push to `main` autonomously — an always-on net under
-that is the single highest-stability lever available. A workflow that
-runs `nix flake check` + the `checks.*` VM suite + a
-`system.build.toplevel` build on push to `main`. **Why:** pillar 1;
-today nothing re-verifies a push. **Done when:** the workflow exists,
-is documented (docs/TESTING.md), and a red run is visible/notifiable;
-the runner requirements (Linux + KVM for the VM checks, or a documented
-no-KVM subset) are written down. **Verify:** V1 locally (the same
-commands the workflow runs) + a real green run on the Forgejo instance
-— if runner infra doesn't exist yet, deliver the workflow + a `[human]`
-note on registering a runner. **Verify the runner half is possible
-before promising it.**
+### 20. Confirm the Forgejo runner is alive `[human]`
+The checks-on-push workflow (`.forgejo/workflows/check.yml`) shipped;
+the repo has `has_actions: true` and the legacy `check.yml` ran 57
+times on an act_runner, but whether that runner still exists is not
+API-visible without auth. Check the first run of the new workflow at
+https://git.bemagri.xyz/bernardo/Nomarchy/actions — if it sits queued,
+re-register an act_runner (docker, `ubuntu-latest` label). **Stretch:**
+a second runner on a NixOS host with `/dev/kvm` (label `nix-kvm`) —
+then uncomment the workflow's `vm-checks` job and the VM suite + real
+builds run in CI too (that upgrades half of item 14 for free).
 
 ### 3. Memory-pressure protection (no more frozen desktops)
 New. A workstation that compiles from source *will* hit memory
@@ -154,10 +150,13 @@ Each is a small, self-contained polish item in the existing patterns:
   `SUPER+CTRL` bind; pairs naturally with theme work.
 
 ### 14. Automated upstream lock bumps (maintainer CI, slices b+c) `[big]`
-ROADMAP § Automated upstream lock bumps — the scheduled half, after
-NOW#2 lands: weekly job runs `nix flake update` (within pinned release
-branches) → full check suite → lands on `main` on green; `v1` promotion
-stays human. Plus the fast-lane note for security bumps.
+ROADMAP § Automated upstream lock bumps — the scheduled half (the
+checks-on-push workflow shipped; see item 20 for the runner status):
+weekly job runs `nix flake update` (within pinned release branches) →
+full check suite → lands on `main` on green; `v1` promotion stays
+human. Plus the fast-lane note for security bumps. Note the current
+runner is eval-only (no KVM) — a green bump run guards eval, not the VM
+suite, until item 20's stretch runner exists.
 
 ### 15. Display profiles — docked/undocked switching
 ROADMAP § Display / monitor management, remaining: true profile