probe: temporary CI workflow for R-168 Part 0 (P1/P2/P3 + Scenario E)

TEMPORARY. Deleted before the session ends. Measures whether a registered runner picks up
a job at all, whether python3 and git are visible to the JOB (not merely present in the
image), whether the source can be obtained with no JavaScript action, and that docker is
NOT reachable from a job.

.gitea/workflows/probe.yml

@@ -0,0 +1,30 @@
+# TEMPORARY probe workflow (R-168, Part 0). DELETED before this session ends — if you are reading
+# this on main, teardown was missed. Measures P1 (a runner picks a job up at all), P2 in situ
+# (python3+git inside the job, not just inside the image), P3 (source without any JavaScript
+# action), and Scenario E's negative (docker must NOT be reachable).
+name: probe
+on: [push]
+jobs:
+  probe:
+    runs-on: felhom-gates
+    steps:
+      - name: P1 - the job runs at all
+        run: echo "P1-OK runner picked up the job"
+
+      - name: P2 in situ - tools visible to the JOB, not just the image
+        run: |
+          echo -n "P2 python3: "; python3 --version
+          echo -n "P2 git:     "; git --version
+
+      - name: P3 - obtain the source with no JavaScript action step
+        run: |
+          echo "P3 pushed sha = $GITHUB_SHA"
+          git clone -q http://gitea.gitea-system.svc.cluster.local:3000/admin/felhom.eu.git src
+          cd src && git checkout -q "$GITHUB_SHA"
+          echo "P3 checked-out sha = $(git rev-parse HEAD)"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA" && echo "P3-OK checkout equals pushed commit" || { echo "P3-FAIL"; exit 1; }
+
+      - name: Scenario E - docker MUST be unreachable
+        run: |
+          if docker ps 2>&1; then echo "E-FAIL docker reachable from the job"; exit 1; fi
+          echo "E-OK docker refused (output above is the refusal)"