ci: add Gitea Actions quality gate and GitHub mirror

- check job: lint + test + vet across both Go modules (root + ingestion)
- mirror job: pushes main + tags to github.com/mathiasb/hyperguild after check passes
- Taskfile: add VERSION/SHORT_SHA vars, fix build/lint/test/vet for multi-module,
  add tag and push tasks — matches cobalt-dingo conventions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,58 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+
+jobs:
+  # ── 1. Quality gate ─────────────────────────────────────────────────────────
+  check:
+    name: Lint / Test / Vet
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: false   # self-hosted: Go cache persists on disk between runs
+
+      - name: Verify toolchain
+        run: |
+          go version
+          task --version
+          govulncheck -version 2>&1 || true
+
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
+            | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
+          golangci-lint --version
+
+      - name: Run checks
+        run: task check
+
+  # ── 2. Mirror to GitHub ─────────────────────────────────────────────────────
+  mirror:
+    name: Mirror to GitHub
+    needs: check
+    runs-on: self-hosted
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Push to GitHub
+        run: |
+          mkdir -p ~/.ssh
+          echo '${{ secrets.GH_DEPLOY_KEY }}' > ~/.ssh/id_rsa_gh_mirror
+          chmod 600 ~/.ssh/id_rsa_gh_mirror
+          ssh-keyscan github.com >> ~/.ssh/known_hosts 2>/dev/null
+          GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa_gh_mirror -o IdentitiesOnly=yes" \
+            git push git@github.com:mathiasb/hyperguild.git HEAD:main --tags
+          rm ~/.ssh/id_rsa_gh_mirror
+          echo "✓ Mirrored to GitHub"