ci: add CI — this repo verified nothing on push

Until now no .gitea/workflows step ran anything here: no build, no test, no
vet, no lint. A push could break the repo and nothing would say so. Found by
infra scripts/check-task-properties.py, a gate that asserts what CI RUNS
rather than what a repo contains (infra v1.6.0).

Runs lint, vet and test. setup-go carries cache: false, matching the rest of
the estate -- this runner keeps GOMODCACHE warm on its own volume, so
setup-go cache restore can only collide with it (infra#360).

Verified before adding, so switching verification on could not turn the repo
red: go build, go vet, go test -race and golangci-lint against the canonical
.golangci.yml all pass at 0 issues. Each command was run exactly as the
workflow spells it, not reasoned about.

Worth noting for this repo in particular: mcp-chassis is a shared library --
gitea-mcp imports it for auth -- so it was the dependency with the least
verification and the widest blast radius.

.gitea/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: CI
+
+# This repo had NO CI at all until 2026-09-05 -- no .gitea/workflows step ran
+# anything, so nothing was verified on push. Found by infra's task-properties
+# gate (scripts/check-task-properties.py), which asserts what CI RUNS rather
+# than what a repo contains.
+#
+# Verified before this was added, so turning verification on could not turn the
+# repo red: go build, go test and golangci-lint against the canonical
+# .golangci.yml all pass at 0 issues.
+
+on: [push]
+
+jobs:
+  check:
+    name: Lint / Test / Vet
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with: { go-version: "1.26", cache: false } # self-hosted runner: Go cache persists on disk between runs (infra#360)
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \
+            | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
+          golangci-lint --version
+
+      - run: golangci-lint run ./...
+      - run: go vet ./...
+      - run: CGO_ENABLED=1 go test -race -count=1 ./...