Add Gitea workflow to sync runner checkout on master changes.

Keeps ~/Documents/repos/server-infra on the Act runner up to date after
direct pushes and merged PRs so CI deploy steps use current playbooks.

IMPLEMENTATION.md

@@ -301,6 +301,10 @@ Server prereqs on 10.0.0.230: create the 4 DBs + grant `westfarn`;
 | `server-infra` checkout | Playbooks + inventory |
 | SSH key to adama + roslin | Deploy fan-out |
 
+On every push or merged PR to `master`, `.gitea/workflows/sync-checkout.yml`
+fast-forward pulls this repo at `~/Documents/repos/server-infra` on the Act
+runner so playbooks and inventory stay current without a manual `git pull`.
+
 ## SSH Keys for CI Deploy
 
 | Key | Used by | Purpose |
@@ -333,6 +337,7 @@ Store vault password for CI in a file readable only by the Act runner (e.g. `~/.
 | 6 | Test on single server: `./scripts/provision.sh adama` | Manual |
 | 7 | Provision all: `./scripts/provision.sh` | Manual |
 | 8 | Deploy SSH key for Act runner | Future |
+| 8a | Auto-sync runner checkout on `master` (`.gitea/workflows/sync-checkout.yml`) | Done |
 | 9 | Stub `deploy-apps.yml` + update `company_site` workflow | Future |
 | 10 | Dockerize `company_site` | Future (separate ticket) |
 | 11 | Gitea container registry (optional) | Future |