CI workflow: the failure mail links the public run page, by run id (R-1135)

The alarm step built its link from GITHUB_SERVER_URL, which on this runner
is the in-cluster Gitea address, and from the run NUMBER, which Gitea 1.26
reads as a run id first (felhom.eu /actions/runs/1116 opened run id 1116 =
run number 613). Now https://gitea.dooplex.hu + GITHUB_RUN_ID, and the link
is printed into the job log as ALARM-LINK. Same change in all four repos.

scripts/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2026-10-18 — CI workflow: the failure mail links the public run page, by run id (R-1135)
+
+`.gitea/workflows/gates.yml`, the alarm step: the mail's run link is now `https://gitea.dooplex.hu/<repo>/actions/runs/<run id>`.
+It used `GITHUB_SERVER_URL`, which on this runner is the in-cluster address (`http://gitea.gitea-system.svc.cluster.local:3000`,
+the address the runner registers at), so nobody outside the cluster could open it. It also used the run NUMBER, and
+Gitea 1.26 reads `/actions/runs/<n>` as a run id first: a number that is also an older run's id opened that other run
+(measured 2026-10-18: `felhom.eu/actions/runs/1116` opened run id 1116, run number 613). It now uses `GITHUB_RUN_ID` and
+prints the link (`ALARM-LINK …`) into the job log. Same change in all four repos' workflows.
+
 ## 2026-10-18 — felhom-host-install.sh 1.34.0 (tag `installer-v1.34.0`, published on the operator's yes 2026-10-18): step 4b vaults FIRST, then sets the password (R-1145); the host key off curl's argv; the harness is a gate (R-1146)
 
 **1.34.0 carries every untagged entry below it since 1.33.0:** this one, `--rotate-recovery-only` (R-1141) and the