CI workflow: a manual proof that the failure mail can be sent (R-1129)

workflow_dispatch with input force_alarm (default false). A dispatch-only
step prints the RESEND_API_KEY length (never the key) and, when forced,
fails so the alarm step sends its real mail, subject marked FORCED TEST.
Push runs are unchanged: the step is skipped, the subject is the old one.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

scripts/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2026-10-17 — CI workflow: a manual proof that the failure mail can be sent (R-1129)
+
+`.gitea/workflows/gates.yml` gains a manual `workflow_dispatch` trigger with one input, `force_alarm` (default false), and
+one step that runs ONLY on a dispatch: it prints the length of `RESEND_API_KEY` (never the key) and, with
+`force_alarm=true`, fails on purpose so the existing alarm step sends its real mail; the mail's subject then starts
+„FORCED TEST, not a real failure". A push run is unchanged: the new step is skipped and the subject is the old one. Same
+change in all four repos' workflows. Purpose: prove the failure mail now goes out after the operator set the key
+(every failed run until today ended „ALARM FAILED: RESEND_API_KEY is empty").
+
 ## 2026-10-17 — reuse_refs_check.py: sibling repos beside the MAIN clone, for a worktree (R-1114)
 
 `find_siblings` reads `FELHOM_WORKSPACE` when set — felhom-controller's runner sets it to the main clone's parent