Add Gitea workflow to sync runner checkout on master changes (#2)

## Summary

Implements #1: Gitea Act workflow that fast-forward pulls `~/Documents/repos/server-infra` on the self-hosted runner whenever `master` changes.

- Adds `.gitea/workflows/sync-checkout.yml`
- Triggers on direct push to `master` and on merged PRs targeting `master`
- Refuses to pull if the working tree is dirty
- Documents the workflow in `IMPLEMENTATION.md`

## Test plan

- [ ] Merge PR → workflow runs on self-hosted runner
- [ ] Runner checkout at `/home/westfarn/Documents/repos/server-infra` advances to latest `master` commit
- [ ] Dirty working tree on runner causes workflow to fail (no silent overwrite)
- [ ] Direct push to `master` also triggers sync

Closes #1

Reviewed-on: #2

.gitea/workflows/sync-checkout.yml

@@ -0,0 +1,36 @@
+name: Sync runner checkout
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    types: [closed]
+    branches: [master]
+
+jobs:
+  sync:
+    if: gitea.event_name == 'push' || gitea.event.pull_request.merged == true
+    runs-on: self-hosted
+    steps:
+      - name: Pull latest server-infra
+        run: |
+          set -euo pipefail
+          REPO="/home/westfarn/Documents/repos/server-infra"
+
+          if [[ ! -d "${REPO}/.git" ]]; then
+            echo "Missing git checkout at ${REPO}"
+            exit 1
+          fi
+
+          cd "${REPO}"
+
+          if ! git diff --quiet || ! git diff --cached --quiet; then
+            echo "Working tree is dirty; refusing to pull"
+            git status --short
+            exit 1
+          fi
+
+          git fetch origin master
+          git checkout master
+          git pull --ff-only origin master
+          git rev-parse --short HEAD

IMPLEMENTATION.md

@@ -301,6 +301,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
 | `server-infra` checkout | Playbooks + inventory |
 | SSH key to adama + roslin | Deploy fan-out |
 
+On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
+fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
+runner so playbooks and inventory stay current without a manual `git pull`.
+
 ## SSH Keys for CI Deploy
 
 | Key | Used by | Purpose |
@@ -333,6 +337,7 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
 | 7 | Provision all: `./scripts/provision.sh` | Manual |
 | 8 | Deploy SSH key for Act runner | Future |
+| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
 | 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
 | 10 | Dockerize `company_site` | Future (separate ticket) |
 | 11 | Gitea container registry (optional) | Future |