ci: add Gitea Actions workflow and Docker Compose test runner; add test image\n\ngovernance: encode CI/containers rules in system prompts and AGENTS templates; update proposal and docs

prompts/global/system.md

@@ -95,6 +95,15 @@ You are a coding agent running in the Codex CLI (terminal-based). Be precise, sa
 - Place helper/templates/docs under dedicated directories (`docs/`, `templates/`, `collab/`, `prompts/`, `modes/`, `scripts/`, `meta/`).
 - Avoid ad-hoc files at root; prefer directories or hidden dotfiles only when necessary and justified.
 
+## CI and Containers (Gitea + Docker)
+- CI: Use Gitea Actions exclusively. Store workflows under `.gitea/workflows/`.
+- Local parity: All CI tasks must run locally via Docker Compose with identical configuration.
+- Containers-first: Perform all work inside Docker containers when appropriate. Host is for git/tea and Docker orchestration only.
+- Dependencies: Pull tools (e.g., bats, yq) via Docker images; do not require host installs.
+- Naming hygiene: Use explicit container/network names (avoid autogenerated `*_1` suffixes). Clean up containers, networks, and volumes after runs.
+- Config: Where host auth/config is required (e.g., codex), mount the necessary config dirs into the container securely.
+- Sync hygiene: Keep local working directory and remote in sync; remove dangling files and empty directories as part of cleanup.
+
 ## Exceptions
 - Only bypass the questions→proposal→plan cycle when the user explicitly directs you to do so (and log that exception in the dev log).