feat(atlas): Phase C increment 1 — live CI runs on the pipeline

The CI stage now shows the pipeline's latest real execution, read live from the
in-cluster Gitea Actions API (public read, no token, gitea-http.gitea.svc):
"▶ run #N · <state>" coloured by outcome, prepended to the generated job list.
LatestRun + RunNode built test-first; cached in the same 30s liveOverlay; falls
back cleanly when Gitea is unreachable.

assessor-loop ledger / session_log deferred: no live CAD data exists for this repo
yet (brain confirms). Gitea run history is the real available trace.

Verified: build/vet/lint(0)/test green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handler.go

@@ -10,6 +10,7 @@ import (
 	cadatlas "git.d-ma.be/mathias/cad-atlas"
 	"git.d-ma.be/mathias/cad-atlas/internal/atlas"
 	"git.d-ma.be/mathias/cad-atlas/internal/cluster"
+	"git.d-ma.be/mathias/cad-atlas/internal/gitea"
 )
 
 // atlasHTML is the Phase-A/B static shell. It fetches /api/atlas.json at load
@@ -44,6 +45,14 @@ func NewHandler() http.Handler {
 		if ld.ns != "" {
 			a.NS = "Tailscale mesh · " + ld.ns
 		}
+		if ld.run != nil {
+			node := atlas.RunNode(*ld.run)
+			for i := range a.Stages {
+				if a.Stages[i].Generate == "ci-jobs" {
+					a.Stages[i].Nodes = append([]atlas.Node{node}, a.Stages[i].Nodes...)
+				}
+			}
+		}
 		w.Header().Set("Content-Type", "application/json; charset=utf-8")
 		_ = json.NewEncoder(w).Encode(a)
 	})
@@ -54,6 +63,7 @@ func NewHandler() http.Handler {
 type liveOverlayData struct {
 	hosts []atlas.Host
 	ns    string
+	run   *atlas.Run
 }
 
 // live cache: query the cluster at most once per TTL; fall back to the authored
@@ -85,6 +95,11 @@ func liveOverlay() liveOverlayData {
 			d.ns = s
 		}
 	}
+	if raw, err := gitea.Runs(); err == nil {
+		if r, err := atlas.LatestRun(raw); err == nil {
+			d.run = &r
+		}
+	}
 	liveCache = d
 	return d
 }