revert(ci): reusable workflows after all — Forgejo 11 supports them

Correction to the previous commit. Forgejo 11.0.15 DOES support reusable
workflows; my earlier "not supported" was a false negative — the test caller
omitted `runs-on`, and the pre-v15 "limited" implementation REQUIRES `runs-on`
on the calling job (omitting it makes Forgejo silently schedule no run). Verified
live: a caller with `runs-on` runs green, same-repo and cross-repo (short ref);
the full-URL form fails for reusable workflows (it was only needed for composite
ACTIONS, which resolve via DEFAULT_ACTIONS_URL).

- Restore the four reusable-*.yml (on: workflow_call), the architecture the
  handover + 999_testing chose; fix the caller examples to include `runs-on`.
- Remove the composite-action layer (actions/) — single mechanism, no redundancy.
- .forgejo/workflows/README.md documents the v11 caller-`runs-on` + short-ref
  quirks (both removed by a future Forgejo v15 upgrade) and the candidate coverage.
- ecosystem-selftest paths filter back to reusable-*.yml.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/reusable-node-build.yml

@@ -0,0 +1,59 @@
+# reusable-node-build — build/test an npm- or bun-based project (999_testing).
+#
+# A REUSABLE workflow (on: workflow_call) downstream repos call:
+#   jobs:
+#     build:
+#       runs-on: docker   # REQUIRED on Forgejo 11 (pre-v15 reusable-workflow quirk; see README)
+#       uses: olsitec/foundation/.forgejo/workflows/reusable-node-build.yml@master
+#       with: { package-manager: bun, build: "bun run build" }
+#
+# Runs in the baked foundation-ci image (bun + node present). Covers the
+# non-Docker candidate shapes: npm package built with npm (olsicrypto), bun
+# package built with bun (document-engine), and the no-build / versioned-only
+# utility (olsitrack/api) via an empty `build`.
+name: reusable-node-build
+on:
+  workflow_call:
+    inputs:
+      package-manager:
+        description: "bun | npm | none (none = skip install)"
+        type: string
+        default: bun
+      build:
+        description: "build command to run verbatim (empty = skip, e.g. no-artifact repos)"
+        type: string
+        default: ""
+      workdir:
+        description: "working directory for install + build"
+        type: string
+        default: "."
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: foundation-ci:latest
+    defaults:
+      run:
+        working-directory: ${{ inputs.workdir }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies (${{ inputs.package-manager }})
+        run: |
+          case "${{ inputs.package-manager }}" in
+            bun)  bun install --frozen-lockfile || bun install ;;
+            npm)  npm ci || npm install ;;
+            none) echo "package-manager=none → skipping install" ;;
+            *)    echo "unknown package-manager '${{ inputs.package-manager }}'" >&2; exit 1 ;;
+          esac
+
+      - name: Build
+        run: |
+          cmd='${{ inputs.build }}'
+          if [ -z "$cmd" ]; then
+            echo "no build command (non-artifact / versioned-only repo) — install-only check passed"
+            exit 0
+          fi
+          echo "+ $cmd"
+          eval "$cmd"