feat(ci): checks-on-push workflow (Forgejo Actions, eval tier)

.forgejo/workflows/check.yml runs on every push to main/v1 (+ manual
dispatch): nix flake check --no-build (full module-system eval incl.
the downstream template through mkFlake), py_compile of
nomarchy-theme-sync, and bash -n over tracked .sh files. The always-on
net under direct-to-main pushes — first slice of the ROADMAP lock-bump
CI item.

Scoped to the eval tier deliberately: the instance's runner is an
act_runner docker container (no systemd, no /dev/kvm — established
from the legacy repo's .gitea/workflows/check.yml, which ran 57 times
on it), so the checks.* VM suite and real builds can't run there. A
commented vm-checks job documents the KVM-runner upgrade path; the
legacy workflow's container gotchas (nixbld setup for the single-user
installer, sandbox=false for Stylix IFD, Nix pinned 2.31.5 vs
lazy-trees, no JS actions past node20) are carried over verbatim in
the header. docs/TESTING.md §1b documents what a green run does and
does not mean.

Verified: V0 locally (the same check commands, minus the container
Nix install) + YAML parse. A real green run depends on the runner
still being registered — not API-visible unauthenticated, so that is
queued as [human] BACKLOG item 20.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/MEMORY.md

@@ -7,6 +7,12 @@ here the moment a debugging session teaches you something a future
 iteration would otherwise rediscover.
 
 ## Testing & VM recipes
+- CI (`.forgejo/workflows/check.yml`) is **eval-tier only**: the Forgejo
+  act_runner is a docker container (no systemd, no /dev/kvm). Container
+  gotchas are documented in the workflow header (single-user Nix +
+  nixbld users, `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs
+  lazy-trees, no JS actions past node20) — learned over the legacy
+  repo's 57 runs; read them before touching the workflow.
 - Reusable headless VM harness: `checks.*` via runNixOSTest — existing
   examples to crib from: `distro-id` (boots + `switch-to-configuration
   dry-activate`), `hardware-toggles` (kernel cmdline/PAM assertions),