feat(ci): scheduled weekly lock bump + dispatch fast-lane (item 14 b+c)

.gitea/workflows/bump.yml: Mondays 05:17 UTC (+ workflow_dispatch for
security bumps), nix flake update — within the pinned release branches
by construction, never a release jump — gated by nix flake check
--no-build, then a pathspec-limited flake.lock commit pushed to main
with the update's change list as the body. That push triggers check.yml
as a second net. Red gate or push race = a visibly failed run, nothing
lands. v1 promotion stays human. py_compile/bash -n deliberately not in
the gate: they don't read the lock. Container recipe inherited from
check.yml (nixbld, sandbox=false, pinned Nix 2.31.5).

Verified: V0 (yq parse, bash -n per run block); the update/commit/push
logic simulated end-to-end in a scratch clone with a real nix flake
update and a bare remote (changed + unchanged branches, bystander file
stays uncommitted, push lands); today's bumped lock evals green.
Remains: the first real run (cron pickup + Actions-token push) is not
confirmable from a session — BACKLOG item 14 slimmed to that watch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,14 +26,17 @@ next, in what order*.
 
 ## NEXT
 
-### 14. Automated upstream lock bumps (maintainer CI, slices b+c) `[big]`
-ROADMAP § Automated upstream lock bumps — the scheduled half (the
-checks-on-push workflow shipped; see item 20 for the runner status):
-weekly job runs `nix flake update` (within pinned release branches) →
-full check suite → lands on `main` on green; `v1` promotion stays
-human. Plus the fast-lane note for security bumps. Note the current
-runner is eval-only (no KVM) — a green bump run guards eval, not the VM
-suite, until item 20's stretch runner exists.
+### 14. Automated lock bumps — confirm the first real run
+Slices b+c shipped 2026-07-05 (`.gitea/workflows/bump.yml`): weekly
+schedule (Mon 05:17 UTC) + `workflow_dispatch` as the security
+fast-lane; `nix flake update` → eval gate → pathspec-limited lock
+commit pushed to `main` on green (that push triggers check.yml as the
+second net). Update/commit/push logic simulated locally end-to-end in
+a scratch clone, incl. a real update; today's bumped lock evals green.
+Remaining (not confirmable from a session): the first scheduled or
+dispatched run must land — watch that the runner picks up the cron and
+that the Actions token can push. Then delete this item. Item 20's KVM
+runner later upgrades the gate from eval-only to the VM suite.
 
 ### 20. KVM runner → VM suite in CI `[human]`
 The remaining stretch of the CI item — checks-on-push is live and