fix(ci): move workflow to .gitea/workflows — the server is Gitea, not Forgejo

The runner was alive all along (gitea/act_runner, ubuntu-latest label);
no run ever appeared because Gitea only reads .gitea/workflows/ (or
.github/workflows/) and ignores the .forgejo/ path the workflow shipped
under. The legacy repo's .gitea/workflows/check.yml was the clue.
References corrected (workflow header, TESTING.md, agent files); this
push doubles as the first live trigger of the workflow.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/MEMORY.md

@@ -7,12 +7,15 @@ here the moment a debugging session teaches you something a future
 iteration would otherwise rediscover.
 
 ## Testing & VM recipes
-- CI (`.forgejo/workflows/check.yml`) is **eval-tier only**: the Forgejo
-  act_runner is a docker container (no systemd, no /dev/kvm). Container
-  gotchas are documented in the workflow header (single-user Nix +
-  nixbld users, `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs
-  lazy-trees, no JS actions past node20) — learned over the legacy
-  repo's 57 runs; read them before touching the workflow.
+- CI (`.gitea/workflows/check.yml`) is **eval-tier only**: the act_runner
+  is a docker container (no systemd, no /dev/kvm). Container gotchas are
+  documented in the workflow header (single-user Nix + nixbld users,
+  `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs lazy-trees, no JS
+  actions past node20) — learned over the legacy repo's 57 runs; read
+  them before touching the workflow.
+- The git server is **Gitea** (gitea/act_runner via docker-compose), NOT
+  Forgejo — workflows are read from `.gitea/workflows/` (or `.github/`),
+  never `.forgejo/workflows/` (a whole push cycle was lost to that).
 - Reusable headless VM harness: `checks.*` via runNixOSTest — existing
   examples to crib from: `distro-id` (boots + `switch-to-configuration
   dry-activate`), `hardware-toggles` (kernel cmdline/PAM assertions),