refactor(ci): composite actions instead of reusable workflows (Forgejo 11)

Forgejo 11.0.15 does NOT support reusable workflows (job-level `uses:` /
`workflow_call`): the call is silently dropped and no run is scheduled (verified
live — a same-repo and a cross-repo reusable call both produced zero runs, while
an equivalent inline job ran green). The working cross-repo reuse primitive here
is the COMPOSITE ACTION referenced by FULL URL (a short-form
`uses: olsitec/foundation/...@master` resolves against the runner's
DEFAULT_ACTIONS_URL = data.forgejo.org, not the local instance, and 404s; the
full-URL form `uses: https://forge.olsitec.net/olsitec/foundation/actions/<x>@master`
was verified green).

- Replace the four reusable-*.yml with composite actions under actions/:
  node-build, docker-build, lint, semantic-release-version (same logic + inputs).
- actions/README.md documents the pattern, the Forgejo-11 limitation, and the
  999_testing candidate coverage (C2/C3/C4 self-contained; C1/C5 blocked on the
  not-yet-published @olsitec package registry).
- ecosystem-selftest paths filter: actions/** (was reusable-*.yml).

The capabilities that need no external repo (semantic-release bump sequence,
eslint/yamllint gates) keep running green via ecosystem-selftest's inline jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/reusable-docker-build.yml

@@ -1,67 +0,0 @@
-# reusable-docker-build — build a Docker image (999_testing candidates C1/C5).
-#
-# A REUSABLE workflow (on: workflow_call) downstream repos call:
-#   jobs:
-#     image:
-#       uses: olsitec/foundation/.forgejo/workflows/reusable-docker-build.yml@master
-#       with: { image: "olsitec/seaspots-homepage:ci", push: false }
-#
-# Builds against the HOST Docker daemon via the mounted socket (the foundation-ci
-# image ships the docker CLI; the runner's valid_volumes allows the mount). NOTE
-# (R5): the host socket is root-equivalent on the forge VM — this is acceptable
-# ONLY for trusted first-party repos until the runner is fenced to its own VM.
-#
-# Candidates C1 (seaspots-homepage) and C5 (token-service) depend on @olsitec
-# packages from a private registry that is not published yet (Stage-2). Their real
-# builds need a registry / npmrc; this workflow proves the docker-build path and
-# accepts a `build-args`/`npmrc` hook for when the registry exists.
-name: reusable-docker-build
-on:
-  workflow_call:
-    inputs:
-      context:
-        type: string
-        default: "."
-      dockerfile:
-        type: string
-        default: "Dockerfile"
-      image:
-        description: "image ref to tag, e.g. name:tag"
-        type: string
-        required: true
-      build-args:
-        description: "newline-separated KEY=VALUE docker --build-arg pairs"
-        type: string
-        default: ""
-      push:
-        description: "push to the foundation registry after build (registry must exist)"
-        type: boolean
-        default: false
-
-jobs:
-  image:
-    runs-on: docker
-    container:
-      image: foundation-ci:latest
-      volumes:
-        - /var/run/docker.sock:/var/run/docker.sock
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Docker build
-        run: |
-          args=""
-          if [ -n "${{ inputs.build-args }}" ]; then
-            while IFS= read -r kv; do
-              [ -z "$kv" ] && continue
-              args="$args --build-arg $kv"
-            done <<'EOF'
-          ${{ inputs.build-args }}
-          EOF
-          fi
-          echo "+ docker build -f ${{ inputs.dockerfile }} -t ${{ inputs.image }} $args ${{ inputs.context }}"
-          docker build -f "${{ inputs.dockerfile }}" -t "${{ inputs.image }}" $args "${{ inputs.context }}"
-
-      - name: Push
-        if: ${{ inputs.push }}
-        run: docker push "${{ inputs.image }}"