fix(P1): Gitea Actions clone auth + .coreci.yml native format rewrite (REQ-183,184)

REQ-183: Fix .gitea/workflows/release.yml — the git clone of the private
coreci repo failed because the clone command had no credentials. The
actions/checkout@v4 step only injects auth for the orca repo. Fix: pass
GITEA_TOKEN env to the Install CoreCI step and embed it in the clone
URL (https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/...).

REQ-184: Rewrite .coreci.yml from the invalid pipelines:/steps:/image:/
commands: format to CoreCI's native jobs:/plugin:/invoke:/vars: format
with a proper DAG (needs:). CoreCI's Pipeline struct only recognizes
jobs:/services:/env: top-level keys — unknown fields are silently dropped
by yaml.Unmarshal, producing an empty Jobs map → zero jobs execute.
The rewrite:
- 8 jobs: go-vet → fan-out (verify-reqs, gosec, govulncheck, gitleaks)
  → build → test → release
- plugin: docker://golang:1.25.12 + invoke: on each job (container path
  with shell-isolated fallback — Go is installed on the runner)
- GITEA_TOKEN via vars: with ${{ secrets.GITEA_TOKEN }} (resolved from
  env via CoreCI's secret resolver os.Getenv fallback)
- CI_COMMIT_BRANCH (tag name on tag push) and CI_COMMIT_SHA for version
  injection — no ${VAR} interpolation in YAML fields (shell expansion
  only works inside invoke: via sh -c)
- No apk add (runner is ubuntu, not alpine — uses curl for tool downloads)
- Release job handles duplicate release (ship workflow creates release
  first with title+body; coreci run attaches binary assets later via API
  fallback if tea releases create fails)
- Release job verifies asset count ≥ 2 (REQ-097 gate C-21) with retry

Root cause: all 87 releases in repo history had zero binary assets
because coreci run never executed any jobs (empty Jobs map from the
invalid format) and the Gitea Actions workflow failed before reaching
coreci run (private repo clone had no credentials).

---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
requirements:
  covered: [183, 184]
  partial: []
---/ci---

.gitea/workflows/release.yml

@@ -18,8 +18,10 @@ jobs:
           go-version: '1.25'
 
       - name: Install CoreCI
+        env:
+          GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
         run: |
-          git clone --depth=1 https://git.cloudinit.dev/coreci/coreci.git /tmp/coreci
+          git clone --depth=1 https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/coreci/coreci.git /tmp/coreci
           cd /tmp/coreci
           CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
           coreci version