feat: add hive-ci module — Forgejo Actions runner for CI

Adds `services.hyperhive.ci` NixOS module that spins up a `hive-ci`
nixos-container running `gitea-actions-runner` against the hive-forge
Forgejo instance. Off by default; opt in with `ci.enable = true` after
generating a runner registration token in Forgejo.

Also adds `.forgejo/workflows/ci.yml` with four jobs: nix flake check,
formatting (nix fmt + cargo fmt), cargo test, and cargo clippy. Jobs
target the `hive-ci` runner label.

Container design mirrors hive-forge (shared host netns, non-ephemeral
state, loopback reach to forge). sandbox-fallback = true since nspawn
containers can't create user-namespaces for nix sandbox.

Closes #175.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

flake.nix

@@ -246,6 +246,7 @@
           agentBaseToplevel = self.packages.x86_64-linux.agent-base-toplevel;
           managerToplevel = self.packages.x86_64-linux.manager-toplevel;
         };
+        hive-ci = ./nix/modules/hive-ci.nix;
         hive-forge = ./nix/modules/hive-forge.nix;
         # Convenience alias: one import covers the full hyperhive host
         # stack (hive-c0re + hive-forge, since hive-c0re already pulls