chore(ci): consolidate Gitea CI (#47)

## Summary

- consolidate vet, tests, lint, smoke, and cross-build into one pull-request-only job
- keep binary releases strictly v-tag-only with release-only write permission
- retain wrapper synchronization only for canonical wrapper changes on main
- pin actions and enforce exact trigger contracts

## Verification

- nix develop --command make check
- trigger mutation contract
- 28-workflow cross-repository actionlint audit

Generated with Claude CodeReviewed-on: #47

Co-authored-by: vickydotbat <vickydotbat@tutamail.com>

README.md

@@ -78,13 +78,14 @@ This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 
 ## CI
 
-PR-first (D7): checks run on pull requests and on push to `main`; the only
-publish event is a `v*` tag (see `runbooks/ci-trigger-standard.md` in sow-docs,
+PR-first (D7): checks run once on pull requests; the only publish event is a
+`v*` tag (see `runbooks/ci-trigger-standard.md` in sow-docs,
 https://git.westgate.pw/ShadowsOverWestgate/sow-docs).
 
-- `test.yml` — vet, test, shellcheck, yamllint, binary smoke (PR + main).
-- `build-binaries.yml` — cross-build all targets (PR + main); on a `v*` tag, upload
-  the binaries, `SHA256SUMS`, and the wrappers to the Gitea release.
+- `ci.yml` — vet, test, shellcheck, yamllint, binary smoke, and cross-build all
+  targets once per pull request.
+- `build-binaries.yml` — on a `v*` tag, cross-build and upload the binaries,
+  `SHA256SUMS`, and the wrappers to the Gitea release.
 - `sync-wrappers.yml` — on a `main` push that touches `wrappers/`, auto-PR the
   canonical wrappers to the consumer repos in `wrappers/consumers.txt`.
   Consumer drift checks run after those PRs merge to `main`, not on the PRs