build: Makefile + gitea CI workflow (M1 tooling)

Makefile targets per ROADMAP M1: build / vet / test / race / cover / check-cover
/ map / vm-proof. check-cover reports any package below a 70% floor (advisory —
not yet a hard gate, since rotate/policy/tui are still below target).

.gitea/workflows/ci.yml enforces the non-negotiable green bar on push/PR:
build + vet + `go test -race ./...` on Go 1.25, installing bash+openssl for the
self-contained test suite. Coverage floors are reported but not enforced until
the lagging packages are lifted (ROADMAP M1). Remote is gitea only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,37 @@
+# Gitea Actions CI for incredigo (self-hosted; remote is gitea only).
+# Enforces the non-negotiable green bar: build + vet + race-clean tests. The go
+# suite is self-contained (fake gopass/psql binaries, httptest emulators) but needs
+# bash + openssl on PATH. Per-package coverage FLOORS are reported, not enforced,
+# until rotate/policy/tui are lifted to target (see docs/ROADMAP.md M1).
+name: ci
+on:
+  push:
+  pull_request:
+
+jobs:
+  build-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install test dependencies (bash + openssl)
+        run: |
+          apt-get update -y
+          apt-get install -y --no-install-recommends bash openssl ca-certificates
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Build
+        run: go build ./... && go build -o /tmp/incredigo ./cmd/incredigo
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Test (race)
+        run: go test -race ./...
+
+      - name: Coverage report (advisory — floors not yet enforced)
+        run: make check-cover || true