Add Gitea workflow to sync runner checkout on master changes (#2)

## Summary

Implements #1: Gitea Act workflow that fast-forward pulls `~/Documents/repos/server-infra` on the self-hosted runner whenever `master` changes.

- Adds `.gitea/workflows/sync-checkout.yml`
- Triggers on direct push to `master` and on merged PRs targeting `master`
- Refuses to pull if the working tree is dirty
- Documents the workflow in `IMPLEMENTATION.md`

## Test plan

- [ ] Merge PR → workflow runs on self-hosted runner
- [ ] Runner checkout at `/home/westfarn/Documents/repos/server-infra` advances to latest `master` commit
- [ ] Dirty working tree on runner causes workflow to fail (no silent overwrite)
- [ ] Direct push to `master` also triggers sync

Closes #1

Reviewed-on: #2

IMPLEMENTATION.md

@@ -301,6 +301,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
 | `server-infra` checkout | Playbooks + inventory |
 | SSH key to adama + roslin | Deploy fan-out |
 
+On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
+fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
+runner so playbooks and inventory stay current without a manual `git pull`.
+
 ## SSH Keys for CI Deploy
 
 | Key | Used by | Purpose |
@@ -333,6 +337,7 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
 | 7 | Provision all: `./scripts/provision.sh` | Manual |
 | 8 | Deploy SSH key for Act runner | Future |
+| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
 | 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
 | 10 | Dockerize `company_site` | Future (separate ticket) |
 | 11 | Gitea container registry (optional) | Future |