feat(ci): scheduled weekly lock bump + dispatch fast-lane (item 14 b+c)

.gitea/workflows/bump.yml: Mondays 05:17 UTC (+ workflow_dispatch for
security bumps), nix flake update — within the pinned release branches
by construction, never a release jump — gated by nix flake check
--no-build, then a pathspec-limited flake.lock commit pushed to main
with the update's change list as the body. That push triggers check.yml
as a second net. Red gate or push race = a visibly failed run, nothing
lands. v1 promotion stays human. py_compile/bash -n deliberately not in
the gate: they don't read the lock. Container recipe inherited from
check.yml (nixbld, sandbox=false, pinned Nix 2.31.5).

Verified: V0 (yq parse, bash -n per run block); the update/commit/push
logic simulated end-to-end in a scratch clone with a real nix flake
update and a bare remote (changed + unchanged branches, bystander file
stays uncommitted, push lands); today's bumped lock evals green.
Remains: the first real run (cron pickup + Actions-token push) is not
confirmable from a session — BACKLOG item 14 slimmed to that watch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -17,6 +17,27 @@ Template:
 
 ---
 
+## 2026-07-05 — scheduled lock-bump workflow (iteration #26, item 14 b+c)
+- **Task:** BACKLOG NEXT#14 `[big]` — split: (a) checks-on-push shipped
+  earlier; this ships (b) the weekly bump + (c) the fast-lane as
+  workflow_dispatch on the same job.
+- **Did:** .gitea/workflows/bump.yml — Mon 05:17 UTC cron + dispatch:
+  nix flake update (pinned branches by construction) → gate `nix flake
+  check --no-build` (py_compile/bash -n skipped: they don't read the
+  lock) → commit --only flake.lock with the update's change list as
+  body → push main (triggers check.yml as second net). Red gate/push
+  race = failed run, nothing lands. Container recipe from check.yml.
+- **Verified:** V0 (yq parse + bash -n each run block); logic simulated
+  end-to-end in a scratch clone with a REAL nix flake update + bare
+  remote: changed/unchanged branches, bystander file stays uncommitted,
+  push lands; today's bumped lock evals green (Monday's baseline).
+  Gitea 1.25.4 confirmed (schedule supported). The real cron pickup +
+  token push are NOT confirmable from here → item 14 slimmed to
+  "confirm first run".
+- **Pending:** watch the first scheduled/dispatched bump run.
+- **Next suggestion:** #16 greeter theming (next codeable item; #15
+  needs its design pass written first).
+
 ## 2026-07-05 — color picker (iteration #25, item 13 final slice → item done)
 - **Task:** BACKLOG NEXT#13 last slice — hyprpicker → clipboard from
   the menu + a direct bind. Item 13 complete; deleted from BACKLOG.