Implement Gitea Actions runner substrate

Makefile

@@ -11,6 +11,7 @@ GITEA_DB_CLUSTER ?= gitea-db
 GITEA_DB_NAMESPACE ?= databases
 REGISTRY_DOCS ?= docs/gitea-container-registry.md docs/gitea-package-registry.md
 EVIDENCE_DOCS ?= docs/observability-operating-evidence.md docs/ci-runner-actions-gitops-ownership.md docs/backup-restore-secret-handoff.md
+RUNNER_DOCS ?= docs/gitea-actions-runner-substrate.md docs/gitea-actions-runner-evidence.md
 SOPS_SENTINEL ?= $(GITEA_VALUES)
 
 ##@ Operator checks
@@ -47,6 +48,34 @@ evidence-docs: ## Print forge evidence and handoff contracts
 		sed -n '1,260p' "$$doc"; \
 	done
 
+runner-docs: ## Print Gitea Actions runner substrate docs and evidence
+	@for doc in $(RUNNER_DOCS); do \
+		printf '\n## %s\n\n' "$$doc"; \
+		sed -n '1,260p' "$$doc"; \
+	done
+
+runner-status: ## Read-only Actions runner, host, and inter-hub registry probes
+	bash tools/gitea-runner-status.sh
+
+check-runner-tools: ## Check local tools used by runner inspection targets
+	@missing=0; \
+	for tool in curl ssh docker; do \
+		if command -v $$tool >/dev/null 2>&1; then \
+			echo "ok: $$tool"; \
+		else \
+			echo "missing: $$tool"; \
+			missing=1; \
+		fi; \
+	done; \
+	for tool in skopeo act_runner; do \
+		if command -v $$tool >/dev/null 2>&1; then \
+			echo "ok: $$tool"; \
+		else \
+			echo "optional: $$tool not found"; \
+		fi; \
+	done; \
+	exit $$missing
+
 ##@ Current Gitea
 
 gitea-deploy: ## Deploy / upgrade current Gitea forge runtime
@@ -77,4 +106,4 @@ help: ## Show this help
 	  /^[a-zA-Z0-9_-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } \
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
-.PHONY: check-tools check-sops registry-docs evidence-docs gitea-deploy gitea-ingress-deploy gitea-status help
+.PHONY: check-tools check-sops registry-docs evidence-docs runner-docs runner-status check-runner-tools gitea-deploy gitea-ingress-deploy gitea-status help