CI: stand up Gitea Actions (TST-03) + fix the defects it caught (#123)

Make the authored CI pipeline execute and go green on the co-located runner (portable + java), fix the five real latent defects the first real run surfaced (codegen-check null, stale rust proto, orphan-terminator Linux path, stale java worker codegen, py3.12 event loop), provision pwsh + Gradle for the self-hosted act image, and disable the Windows jobs (act host-mode broken). TST-03 -> Done.

https://claude.ai/code/session_01DMXXvNuPekkkrTEyPNxEkW

.gitea/workflows/ci.yml

@@ -49,6 +49,13 @@ jobs:
       - name: Build NonWindows solution
         run: dotnet build src/ZB.MOM.WW.MxGateway.NonWindows.slnx -c Release
 
+      # GitHub-hosted runners ship pwsh; the self-hosted act image does not. Install it as a
+      # .NET global tool (the SDK is already set up above) so the codegen check's `shell: pwsh` works.
+      - name: Install PowerShell (pwsh)
+        run: |
+          dotnet tool install --global PowerShell
+          echo "$HOME/.dotnet/tools" >> "$GITHUB_PATH"
+
       # IPC-01 / IPC-19 / IPC-20: descriptor set + Contracts/Generated must match the current protos.
       - name: Codegen / descriptor freshness
         shell: pwsh
@@ -93,11 +100,23 @@ jobs:
         with:
           distribution: temurin
           java-version: '17'
+      # GitHub-hosted runners ship gradle on PATH; the self-hosted act image does not, and the repo
+      # has no gradle wrapper. act also can't resolve the gradle/actions monorepo action, so install
+      # gradle directly (pinned to 9.5.1, matching the local homebrew build in CLAUDE.md/memory).
+      - name: Install Gradle 9.5.1
+        run: |
+          curl -sSL "https://services.gradle.org/distributions/gradle-9.5.1-bin.zip" -o /tmp/gradle.zip
+          sudo unzip -q -d /opt/gradle /tmp/gradle.zip
+          echo "/opt/gradle/gradle-9.5.1/bin" >> "$GITHUB_PATH"
       - name: Gradle test
         working-directory: clients/java
         run: gradle test
       - name: Revert spurious protobuf-version churn (no .proto changed)
-        run: git checkout -- clients/java/src/main/generated/main/java/mxaccess_gateway/v1/MxaccessGateway.java || true
+        # Both generated aggregates can pick up protobuf-runtime-version churn on regen; revert
+        # both so verify-clean still catches a real, uncommitted proto/codegen change elsewhere.
+        run: |
+          git checkout -- clients/java/src/main/generated/main/java/mxaccess_gateway/v1/MxaccessGateway.java || true
+          git checkout -- clients/java/src/main/generated/main/java/mxaccess_worker/v1/MxaccessWorker.java || true
       - name: Verify generated tree is clean
         run: git diff --exit-code -- clients/java/src/main/generated
 
@@ -105,8 +124,23 @@ jobs:
     # Self-hosted windev runner (10.100.0.48): the only host that can build the x86 / net48 Worker
     # and MXAccess-adjacent code. Not required for a green portable build; runs where a runner exists.
     runs-on: [self-hosted, windows]
+    # DISABLED pending a working Windows runner. act_runner v0.6.1 host-mode on Windows is broken:
+    # its hostexecutor writes each step's script to a path it then cannot resolve ("The system
+    # cannot find the path specified" / pwsh "not recognized"), independent of shell, and it cannot
+    # stage JS actions (actions/checkout dist/ missing). Windows containers are impractical for the
+    # net48/x86/MXAccess Worker. Until this is resolved, x86 Worker verification stays on the manual
+    # windev worktree process. Re-enable by setting repo variable WINDOWS_CI_ENABLED=true.
+    if: ${{ vars.WINDOWS_CI_ENABLED == 'true' }}
+    defaults:
+      run:
+        shell: cmd
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (manual)
+        run: |
+          git init -q .
+          git remote add origin https://gitea.dohertylan.com/%GITHUB_REPOSITORY%
+          git -c protocol.version=2 fetch -q --depth 1 origin %GITHUB_SHA%
+          git checkout -q --force FETCH_HEAD
       - name: Build x86 Worker
         run: dotnet build src/ZB.MOM.WW.MxGateway.Worker/ZB.MOM.WW.MxGateway.Worker.csproj -p:Platform=x86
       - name: Worker tests
@@ -114,11 +148,21 @@ jobs:
 
   live-mxaccess:
     # Opt-in, scheduled only — needs installed MXAccess COM + live provider state. Never gates a push.
-    if: ${{ github.event_name == 'schedule' }}
+    # Also gated by WINDOWS_CI_ENABLED (see the windows job): the Windows host-mode runner is broken.
+    if: ${{ github.event_name == 'schedule' && vars.WINDOWS_CI_ENABLED == 'true' }}
     runs-on: [self-hosted, windows, mxaccess]
     env:
       MXGATEWAY_RUN_LIVE_MXACCESS_TESTS: '1'
+    # Same act host-mode constraint as the windows job above.
+    defaults:
+      run:
+        shell: cmd
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (manual)
+        run: |
+          git init -q .
+          git remote add origin https://gitea.dohertylan.com/%GITHUB_REPOSITORY%
+          git -c protocol.version=2 fetch -q --depth 1 origin %GITHUB_SHA%
+          git checkout -q --force FETCH_HEAD
       - name: Live MXAccess smoke
         run: dotnet test src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj --filter FullyQualifiedName~WorkerLiveMxAccessSmokeTests