feat(atlas): Phase C increment 1 — live CI runs on the pipeline

The CI stage now shows the pipeline's latest real execution, read live from the
in-cluster Gitea Actions API (public read, no token, gitea-http.gitea.svc):
"▶ run #N · <state>" coloured by outcome, prepended to the generated job list.
LatestRun + RunNode built test-first; cached in the same 30s liveOverlay; falls
back cleanly when Gitea is unreachable.

assessor-loop ledger / session_log deferred: no live CAD data exists for this repo
yet (brain confirms). Gitea run history is the real available trace.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/gitea/client.go

@@ -0,0 +1,39 @@
+// Package gitea reads the repo's own Gitea Actions run history from the
+// in-cluster Gitea service (public read — no token), so the atlas can show the
+// pipeline's live executions.
+package gitea
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"time"
+)
+
+// base is the in-cluster Gitea service by default; override with GITEA_BASE.
+func base() string {
+	if b := os.Getenv("GITEA_BASE"); b != "" {
+		return b
+	}
+	return "http://gitea-http.gitea.svc.cluster.local:3000"
+}
+
+// Runs returns the raw /actions/tasks JSON for mathias/cad-atlas (newest first).
+func Runs() ([]byte, error) {
+	url := base() + "/api/v1/repos/mathias/cad-atlas/actions/tasks?limit=1"
+	client := &http.Client{Timeout: 5 * time.Second}
+	resp, err := client.Get(url) //nolint:noctx // short-lived, timeout on the client
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	if err != nil {
+		return nil, err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("gitea runs: %s", resp.Status)
+	}
+	return body, nil
+}