refactor(ci): composite actions instead of reusable workflows (Forgejo 11)

Forgejo 11.0.15 does NOT support reusable workflows (job-level `uses:` /
`workflow_call`): the call is silently dropped and no run is scheduled (verified
live — a same-repo and a cross-repo reusable call both produced zero runs, while
an equivalent inline job ran green). The working cross-repo reuse primitive here
is the COMPOSITE ACTION referenced by FULL URL (a short-form
`uses: olsitec/foundation/...@master` resolves against the runner's
DEFAULT_ACTIONS_URL = data.forgejo.org, not the local instance, and 404s; the
full-URL form `uses: https://forge.olsitec.net/olsitec/foundation/actions/<x>@master`
was verified green).

- Replace the four reusable-*.yml with composite actions under actions/:
  node-build, docker-build, lint, semantic-release-version (same logic + inputs).
- actions/README.md documents the pattern, the Forgejo-11 limitation, and the
  999_testing candidate coverage (C2/C3/C4 self-contained; C1/C5 blocked on the
  not-yet-published @olsitec package registry).
- ecosystem-selftest paths filter: actions/** (was reusable-*.yml).

The capabilities that need no external repo (semantic-release bump sequence,
eslint/yamllint gates) keep running green via ecosystem-selftest's inline jobs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

actions/lint/action.yml

@@ -0,0 +1,47 @@
+# lint — eslint + yamllint gate (999_testing "linter testing"). Composite action
+# (see actions/node-build for why composite, not reusable workflow). Either linter
+# finding an error makes the step (hence the job) exit non-zero.
+#
+#   steps:
+#     - uses: actions/checkout@v4
+#     - uses: https://forge.olsitec.net/olsitec/foundation/actions/lint@master
+#       with: { eslint-paths: ".", yamllint-paths: "." }
+name: lint
+description: Run eslint and yamllint; any error fails the job.
+inputs:
+  eslint:
+    description: "run eslint (true/false)"
+    default: "true"
+  yamllint:
+    description: "run yamllint (true/false)"
+    default: "true"
+  eslint-paths:
+    default: "."
+  yamllint-paths:
+    default: "."
+  package-manager:
+    description: "bun | npm | none — to install project-local eslint config/plugins"
+    default: bun
+runs:
+  using: composite
+  steps:
+    - name: eslint
+      if: ${{ inputs.eslint == 'true' }}
+      shell: bash
+      run: |
+        case "${{ inputs.package-manager }}" in
+          bun)  bun install --frozen-lockfile || bun install || true ;;
+          npm)  npm ci || npm install || true ;;
+          none) echo "skip install" ;;
+        esac
+        if [ -x node_modules/.bin/eslint ]; then
+          echo "+ project eslint"; node_modules/.bin/eslint ${{ inputs.eslint-paths }}
+        else
+          echo "+ image eslint"; eslint ${{ inputs.eslint-paths }}
+        fi
+    - name: yamllint
+      if: ${{ inputs.yamllint == 'true' }}
+      shell: bash
+      run: |
+        echo "+ yamllint ${{ inputs.yamllint-paths }}"
+        yamllint ${{ inputs.yamllint-paths }}