feat: add hive-ci module — Forgejo Actions runner for CI

Adds `services.hyperhive.ci` NixOS module that spins up a `hive-ci`
nixos-container running `gitea-actions-runner` against the hive-forge
Forgejo instance. Off by default; opt in with `ci.enable = true` after
generating a runner registration token in Forgejo.

Also adds `.forgejo/workflows/ci.yml` with four jobs: nix flake check,
formatting (nix fmt + cargo fmt), cargo test, and cargo clippy. Jobs
target the `hive-ci` runner label.

Container design mirrors hive-forge (shared host netns, non-ephemeral
state, loopback reach to forge). sandbox-fallback = true since nspawn
containers can't create user-namespaces for nix sandbox.

Closes #175.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.forgejo/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  check:
+    name: nix flake check
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: check
+        run: nix flake check --no-build
+
+  fmt:
+    name: formatting
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: nix fmt
+        run: nix fmt -- --check .
+      - name: cargo fmt
+        run: cargo fmt --all -- --check
+
+  test:
+    name: cargo test
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: test
+        run: cargo test --workspace
+
+  clippy:
+    name: cargo clippy
+    runs-on: [hive-ci]
+    steps:
+      - uses: actions/checkout@v3
+      - name: clippy
+        run: cargo clippy --workspace -- -D warnings