feat(ci): reusable ecosystem workflows + selftest (999_testing)

The ecosystem-CI architecture: reusable Forgejo workflows (on: workflow_call)
that downstream repos reference as
`uses: olsitec/foundation/.forgejo/workflows/<x>.yml@master`.

- reusable-node-build.yml: install + build for npm/bun/none — covers the npm
  package (olsicrypto), bun package (document-engine), and no-artifact versioned
  (olsitrack/api) shapes.
- reusable-docker-build.yml: docker build via the host socket (R5: trusted repos
  only until the runner is fenced) — the seaspots-homepage / token-service shape.
- reusable-lint.yml: eslint + yamllint gate (either error → job non-zero).
- reusable-semantic-release.yml: conventionalcommits-preset version probe (dry-run),
  faithful to the GitLab template; outputs the computed next version. Real Forgejo
  publishing deferred (no @semantic-release/forgejo analogue yet).

- ecosystem-selftest.yml + ci/semantic-release-bumptest.sh: self-contained proof
  on the runner of the 999_testing acceptance criteria that need no external repo —
  the semantic-release bump sequence (1.0.0→1.1.0→1.1.1→2.0.0→3.0.0) and the
  eslint/yamllint non-zero-exit gates. Validated in a foundation-ci container.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.forgejo/workflows/reusable-lint.yml

@@ -0,0 +1,63 @@
+# reusable-lint — eslint + yamllint gate (999_testing "linter testing").
+#
+# A REUSABLE workflow (on: workflow_call). Either linter finding an error makes
+# the job exit non-zero (the acceptance criterion). Prefers the project's own
+# pinned eslint (node_modules/.bin) for config/plugin fidelity, falling back to
+# the foundation-ci image's global eslint; yamllint comes from the image.
+#
+#   jobs:
+#     lint:
+#       uses: olsitec/foundation/.forgejo/workflows/reusable-lint.yml@master
+#       with: { eslint-paths: ".", yamllint-paths: "." }
+name: reusable-lint
+on:
+  workflow_call:
+    inputs:
+      eslint:
+        type: boolean
+        default: true
+      yamllint:
+        type: boolean
+        default: true
+      eslint-paths:
+        type: string
+        default: "."
+      yamllint-paths:
+        type: string
+        default: "."
+      package-manager:
+        description: "bun | npm | none — to install project-local eslint config/plugins"
+        type: string
+        default: bun
+
+jobs:
+  lint:
+    runs-on: docker
+    container:
+      image: foundation-ci:latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies (project-local eslint config/plugins)
+        if: ${{ inputs.eslint }}
+        run: |
+          case "${{ inputs.package-manager }}" in
+            bun)  bun install --frozen-lockfile || bun install || true ;;
+            npm)  npm ci || npm install || true ;;
+            none) echo "skip install" ;;
+          esac
+
+      - name: eslint
+        if: ${{ inputs.eslint }}
+        run: |
+          if [ -x node_modules/.bin/eslint ]; then
+            echo "+ project eslint"; node_modules/.bin/eslint ${{ inputs.eslint-paths }}
+          else
+            echo "+ image eslint"; eslint ${{ inputs.eslint-paths }}
+          fi
+
+      - name: yamllint
+        if: ${{ inputs.yamllint }}
+        run: |
+          echo "+ yamllint ${{ inputs.yamllint-paths }}"
+          yamllint ${{ inputs.yamllint-paths }}