docs(agent): defer #20 KVM CI to FUTURE; keep eval-only VPS

Standing decision: IONOS Gitea/act_runner docker stays eval-tier.
vm-checks needs a separate KVM host later — not the 4G compose box.

agent/MEMORY.md

@@ -30,12 +30,12 @@ iteration would otherwise rediscover.
   realise it): extract the logic into a pure importable file and
   unit-test THAT (monitor-rules.nix / checks.display-profiles is the
   pattern).
-- CI (`.gitea/workflows/check.yml`) is **eval-tier only**: the act_runner
-  is a docker container (no systemd, no /dev/kvm). Container gotchas are
-  documented in the workflow header (single-user Nix + nixbld users,
-  `sandbox=false` for Stylix IFD, Nix pinned 2.31.5 vs lazy-trees, no JS
-  actions past node20) — learned over the legacy repo's 57 runs; read
-  them before touching the workflow.
+- CI (`.gitea/workflows/check.yml`) is **eval-tier only** (standing
+  decision 2026-07-10): act_runner docker-compose on the Gitea VPS; no
+  KVM there. Full VM suite is BACKLOG **FUTURE #20**, not NEXT — needs a
+  separate nix+/dev/kvm runner. Container gotchas are in the workflow
+  header (single-user Nix + nixbld users, `sandbox=false` for Stylix
+  IFD, Nix pinned 2.31.5 vs lazy-trees, no JS actions past node20).
 - The Gitea instance is **1.25.4** — `on: schedule` workflows are
   supported; bump.yml assumes the Actions token can push to `main`
   (standard Gitea behaviour, but unconfirmed until the first run lands).