chore(ci): consolidate Gitea CI (#47)

## Summary

- consolidate vet, tests, lint, smoke, and cross-build into one pull-request-only job
- keep binary releases strictly v-tag-only with release-only write permission
- retain wrapper synchronization only for canonical wrapper changes on main
- pin actions and enforce exact trigger contracts

## Verification

- nix develop --command make check
- trigger mutation contract
- 28-workflow cross-repository actionlint audit

Generated with Claude CodeReviewed-on: #47

Co-authored-by: vickydotbat <vickydotbat@tutamail.com>

.gitea/workflows/sync-wrappers.yml

@@ -14,11 +14,14 @@ on:
       - 'wrappers/crucible.sh'
       - 'wrappers/crucible.ps1'
 
+permissions: read-all
+
 jobs:
   sync:
     runs-on: nix-docker
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Open sync PRs to consumers
         env: