Replace the CI workflow with a make gate target

Gitea Actions is enabled on the instance and the workflow file was
correct, but no act_runner is registered: the push produced zero workflow
runs and the job would queue forever. A workflow that cannot run is worse
than none, because it implies pushes are gated when they are not.

`make gate` runs the same checks locally and is verify-only - gofmt -l must
print nothing and the file is never rewritten. The existing `check` target
stays and keeps its rewriting behaviour; its comment now says so, because
conflating a fixer with a gate is how an unformatted file reaches main.

The workflow is in history at 43116fa if a runner ever appears.

.gitea/workflows/ci.yml

@@ -1,36 +0,0 @@
-name: CI
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.26'
-
-      - name: gofmt
-        run: test -z "$(gofmt -l .)"
-
-      - run: go build ./...
-
-      - run: go vet ./...
-
-      - run: go test ./...
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - uses: pnpm/action-setup@v4
-        with:
-          version: '12'
-
-      - name: web check
-        working-directory: web
-        run: pnpm install --frozen-lockfile && pnpm check

Makefile

@@ -7,7 +7,7 @@ BINARY  := vellum
 VERSION ?= 0.4.0-dev
 LDFLAGS := -s -w -X main.version=$(VERSION)
 
-.PHONY: build web build-go dev run test fmt vet tidy check docker clean
+.PHONY: build web build-go dev run test fmt vet tidy check gate docker clean
 
 # Backend + Vite dev server together, with hot reload. Ctrl-C stops both.
 dev:
@@ -39,9 +39,22 @@ vet:
 tidy:
 	go mod tidy
 
-# What CI should run.
+# Fix formatting, then vet and test. Rewrites files, so it is a fixer, not a
+# gate — use `gate` before pushing.
 check: fmt vet test
 
+# The same checks as check, but verify-only: gate never rewrites a file.
+gate:
+	gofmt_out=$$(gofmt -l .); if [ -n "$$gofmt_out" ]; then echo "gofmt: not formatted:"; echo "$$gofmt_out"; exit 1; fi
+	echo "go build"
+	go build ./...
+	echo "go vet"
+	go vet ./...
+	echo "go test"
+	go test ./...
+	echo "web check"
+	cd web && pnpm install --frozen-lockfile && pnpm check
+
 docker:
 	podman build --build-arg VERSION=$(VERSION) -t localhost/vellum:$(VERSION) .