CI workflow: a manual proof that the failure mail can be sent (R-1129)

workflow_dispatch with input force_alarm (default false). A dispatch-only
step prints the RESEND_API_KEY length (never the key) and, when forced,
fails so the alarm step sends its real mail, subject marked FORCED TEST.
Push runs are unchanged. No controller release, no code change.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,12 @@
+## Unreleased (2026-10-17) — CI workflow: a manual proof that the failure mail can be sent (R-1129); no code change
+
+`.gitea/workflows/gates.yml` gains a manual `workflow_dispatch` trigger with one input, `force_alarm` (default false), and
+one step that runs ONLY on a dispatch: it prints the length of `RESEND_API_KEY` (never the key) and, with
+`force_alarm=true`, fails on purpose so the existing alarm step sends its real mail; the mail's subject then starts
+„FORCED TEST, not a real failure". A push run is unchanged: the new step is skipped and the subject is the old one. Same
+change in all four repos' workflows. Purpose: prove the failure mail now goes out after the operator set the key
+(every failed run until today ended „ALARM FAILED: RESEND_API_KEY is empty").
+
 ## v0.326.0 — FileBrowser's default password is checked at every FileBrowser start; the decoy suite is a gate (2026-10-17)
 
 **MinAgent: 0.158.1** — the floor's, carried. Nothing here calls the agent. No golden (`09` §3 decision 250). Task: