ANW-30 CI: Forgejo build workflow -- on-demand build + release for amd64/arm64

Forgejo-side counterpart to the GitHub release.yml (ANW-29). Driven by
workflow_dispatch (UI or API) rather than a release-published event, so a
build can be triggered for a test. Builds the release binary natively per
target, runs the test suite first, and publishes the assets to a Forgejo
release via actions/forgejo-release.

Assumed runner labels linux-amd64 / macos-arm64 must match the forge's
act_runner registration; arm64 needs a native Apple Silicon runner. Flagged
to aav -- correct if the topology differs.

.forgejo/workflows/build.yml

@@ -0,0 +1,118 @@
+# Forgejo build + release for anwesen ([ANW-30]).
+#
+# The operator's Forgejo forge is the primary home (the GitHub mirror's
+# release.yml under .github/ is the secondary). This workflow is the
+# Forgejo-side counterpart: it builds the release binaries for both targets
+# and publishes them to a Forgejo release.
+#
+# Unlike the GitHub workflow it is NOT driven by a release-published event.
+# It runs on demand -- from the Forgejo UI ("Run workflow") or via the API:
+#
+#   POST /api/v1/repos/{owner}/{repo}/actions/workflows/build.yml/dispatches
+#
+# so a build can be triggered for a test without first cutting a release.
+# The `tag` input names the release the assets attach to; `prerelease`
+# defaults true so test runs land as a replaceable prerelease rather than a
+# stable release. forgejo-release creates the release (from the checked-out
+# sha) if it does not exist, and `override: true` lets a re-run replace the
+# assets.
+name: build
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag the binaries attach to (created if absent).
+        required: true
+        default: nightly
+      prerelease:
+        description: Mark the release as a prerelease.
+        type: boolean
+        default: true
+
+# forgejo-release uploads assets to a release in this repository.
+permissions:
+  contents: write
+
+jobs:
+  build:
+    name: ${{ matrix.label }}
+    # NOTE: these labels must match the labels your act_runner registered
+    # with -- adjust to your forge's runner topology. `linux-amd64` assumes a
+    # Linux host with a C toolchain (cc/ld) for the native build; `macos-arm64`
+    # assumes a native Apple Silicon macOS runner. There is no GitHub-hosted
+    # macOS on a self-hosted forge, so the arm64 build needs a registered Mac.
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      # One target's failure should not cancel the other's build.
+      fail-fast: false
+      matrix:
+        include:
+          # amd64 Linux -- the deploy target. Built natively.
+          - runner: linux-amd64
+            label: x86_64-linux
+            os: linux
+          # arm macOS (apple silicon) -- aav's local machine. Built natively.
+          - runner: macos-arm64
+            label: aarch64-macos
+            os: macos
+    steps:
+      - name: Check out the workflow ref
+        uses: actions/checkout@v4
+
+      # Stable channel; edition 2024 needs >= 1.85, and Cargo.toml pins the
+      # MSRV at 1.95. Pin an explicit version here if a frozen release
+      # toolchain is ever required.
+      - name: Install the Rust toolchain
+        uses: https://github.com/dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo registry, index, and target
+        uses: https://github.com/Swatinem/rust-cache@v2
+
+      # The HTTP contract harness (tests/run-hurl.sh, per ADR-008) boots
+      # `anwesen serve` and runs hurl against it -- headless, so it runs in CI.
+      # The HTTP contract is arch-independent, so it runs once on Linux; the
+      # macOS runner's stock bash is 3.2 and the harness needs bash 4+
+      # (`shopt -s globstar`), which would only add fragility for no extra
+      # coverage.
+      - name: Install hurl
+        if: matrix.os == 'linux'
+        run: |
+          curl -fsSL -o /tmp/hurl.deb \
+            https://github.com/Orange-OpenSource/hurl/releases/download/8.0.0/hurl_8.0.0_amd64.deb
+          sudo dpkg -i /tmp/hurl.deb
+
+      # Test before building the artifact so a release never ships a red build.
+      # The debug build here is what run-hurl.sh exercises.
+      - name: Run the Rust test suite
+        run: cargo test --locked
+
+      - name: Run the HTTP contract tests
+        if: matrix.os == 'linux'
+        run: tests/run-hurl.sh
+
+      - name: Build the release binary
+        run: cargo build --release --locked
+
+      # The runner is native to its target, so target/release/anwesen is the
+      # target binary. forgejo-release uploads everything under the release
+      # dir, so the staged name is the asset name -- make the target explicit.
+      - name: Stage the asset for its target
+        run: |
+          mkdir -p dist/release
+          install -m 0755 target/release/anwesen \
+            "dist/release/anwesen-${{ inputs.tag }}-${{ matrix.label }}"
+
+      - name: Publish the binary to the Forgejo release
+        uses: https://code.forgejo.org/actions/forgejo-release@v2
+        with:
+          direction: upload
+          url: ${{ env.GITHUB_SERVER_URL }}
+          repo: ${{ github.repository }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          tag: ${{ inputs.tag }}
+          sha: ${{ github.sha }}
+          release-dir: dist/release
+          prerelease: ${{ inputs.prerelease }}
+          # A re-run for the same tag replaces the assets rather than failing.
+          override: true