refactor(ci): composite actions instead of reusable workflows (Forgejo 11)

Forgejo 11.0.15 does NOT support reusable workflows (job-level `uses:` /
`workflow_call`): the call is silently dropped and no run is scheduled (verified
live — a same-repo and a cross-repo reusable call both produced zero runs, while
an equivalent inline job ran green). The working cross-repo reuse primitive here
is the COMPOSITE ACTION referenced by FULL URL (a short-form
`uses: olsitec/foundation/...@master` resolves against the runner's
DEFAULT_ACTIONS_URL = data.forgejo.org, not the local instance, and 404s; the
full-URL form `uses: https://forge.olsitec.net/olsitec/foundation/actions/<x>@master`
was verified green).

- Replace the four reusable-*.yml with composite actions under actions/:
  node-build, docker-build, lint, semantic-release-version (same logic + inputs).
- actions/README.md documents the pattern, the Forgejo-11 limitation, and the
  999_testing candidate coverage (C2/C3/C4 self-contained; C1/C5 blocked on the
  not-yet-published @olsitec package registry).
- ecosystem-selftest paths filter: actions/** (was reusable-*.yml).

The capabilities that need no external repo (semantic-release bump sequence,
eslint/yamllint gates) keep running green via ecosystem-selftest's inline jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/reusable-semantic-release.yml

@@ -1,81 +0,0 @@
-# reusable-semantic-release — compute the next semver from conventional commits
-# (999_testing "semantic-release testing"). Mirrors the canonical GitLab template
-# (olsitec/gitlab ci_templates/release-automation/semantic-release.yaml): the
-# conventionalcommits preset + Olsitec's releaseRules, run as a `--dry-run --no-ci
-# --tag-format '${version}'` version probe. Exposes the computed version as an output.
-#
-#   jobs:
-#     version:
-#       uses: olsitec/foundation/.forgejo/workflows/reusable-semantic-release.yml@master
-#     build:
-#       needs: version
-#       runs-on: docker
-#       steps: [ run: echo "releasing ${{ needs.version.outputs.version }}" ]
-#
-# NOTE: dry-run only — it computes/prints the next version (the part exercised by
-# 999_testing and the GitLab `generate-release-version` job). Actually PUBLISHING a
-# release to Forgejo (tag + release + changelog) needs a Forgejo-side publish step
-# and a token; that is deferred until the package/release flow is wired (the GitLab
-# template publishes via @semantic-release/gitlab, which has no Forgejo analogue yet).
-name: reusable-semantic-release
-on:
-  workflow_call:
-    inputs:
-      branch:
-        type: string
-        default: master
-    outputs:
-      version:
-        description: "next release version (empty if the commits warrant no release)"
-        value: ${{ jobs.version.outputs.version }}
-
-jobs:
-  version:
-    runs-on: docker
-    container:
-      image: foundation-ci:latest
-    outputs:
-      version: ${{ steps.compute.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # semantic-release needs full history + tags
-
-      - name: Write .releaserc.yaml (Olsitec conventionalcommits ruleset)
-        run: |
-          cat > .releaserc.yaml <<'EOF'
-          branches:
-            - name: ${{ inputs.branch }}
-          tagFormat: "${version}"
-          plugins:
-            - - "@semantic-release/commit-analyzer"
-              - preset: conventionalcommits
-                releaseRules:
-                  - { breaking: true, release: major }
-                  - { type: breaking, release: major }
-                  - { type: feature, release: minor }
-                  - { type: feat, release: minor }
-                  - { type: fix, release: patch }
-                  - { type: build, release: patch }
-                  - { type: chore, release: patch }
-                  - { type: ci, release: patch }
-                  - { type: docs, release: patch }
-                  - { type: perf, release: patch }
-                  - { type: refactor, release: patch }
-                  - { type: style, release: patch }
-                  - { type: test, release: patch }
-                parserOpts:
-                  noteKeywords: [ "BREAKING CHANGE", "BREAKING CHANGES" ]
-            - "@semantic-release/release-notes-generator"
-          EOF
-
-      - name: Compute next version (dry-run)
-        id: compute
-        run: |
-          out=$(semantic-release --dry-run --no-ci --tag-format '${version}' --branches "${{ inputs.branch }}" 2>&1 || true)
-          printf '%s\n' "$out"
-          ver=$(printf '%s\n' "$out" \
-            | grep -oiE 'next release version is [0-9]+\.[0-9]+\.[0-9]+' \
-            | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | tail -1)
-          echo "computed next version: ${ver:-<none>}"
-          echo "version=$ver" >> "$GITHUB_OUTPUT"