ci: Forgejo Actions workflow for orchestrator-llm

Mirrors the workflow in fai/platform: Linux x86_64 only, manual
checkout via the external URL to bypass DinD network isolation,
fmt/clippy/build/test on host, plus an explicit wasm32-wasip2
release build to confirm the module still produces a valid WASM
component.

See fai/platform docs/architecture/ci.md for the rationale on
why we don't use actions/checkout.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/ci.yml

@@ -0,0 +1,68 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      # See fai/platform docs/architecture/ci.md for why we
+      # check out via the external URL instead of using
+      # actions/checkout.
+      - name: Checkout via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl \
+            ca-certificates \
+            build-essential \
+            pkg-config \
+            libssl-dev \
+            git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y \
+              --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 \
+              --component rustfmt \
+              --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --workspace --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --workspace --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --workspace --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2