chore: initial bootstrap — 5 reusable workflows + scaffolding

Public-readable Tier-1 exception (alongside sporel-meta) for the
practical reason that community pipelines need to call into these
workflows without per-repo deploy-token setup.

5 reusable workflows moved from sporel-meta/.gitea/workflows/ to here
(Plan-B.1: privacy-fix for sporel-meta which stays private with the
proprietary design docs).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/reusable-hybrid.yml

@@ -0,0 +1,83 @@
+# Reusable workflow: Hybrid C+Lua Module (Cat 4 per ADR-0025)
+# Combines Cat 2 (C-build) + Cat 3 (Lua-lint) for modules with native code.
+name: Hybrid Module CI
+
+on:
+  workflow_call:
+    inputs:
+      engine_release_tag:
+        type: string
+        default: "latest"
+      build_type:
+        type: string
+        default: "Release"
+      lint_target:
+        type: string
+        default: "lua/ scripts/ init.lua"
+
+jobs:
+  lint-lua:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install luacheck
+        run: sudo apt-get install -y luarocks && sudo luarocks install luacheck
+      - name: Run luacheck
+        run: luacheck ${{ inputs.lint_target }} --no-unused-args --no-self
+      - name: Manifest + README + LICENSE
+        run: |
+          for f in manifest.module manifest.core lib.json dependencies.json; do
+            [ -f "$f" ] && python3 -c "import json; json.load(open('$f'))"
+          done
+          test -s README.md && test -s LICENSE
+
+  build-c:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Download engine release
+        shell: bash
+        env:
+          GITEA_API: "https://git.davoryn.de/api/v1"
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          OS_TAG="${{ matrix.os }}"
+          OS_TAG="${OS_TAG//-latest/}"
+          TAG="${{ inputs.engine_release_tag }}"
+          if [ "$TAG" = "latest" ]; then
+            TAG=$(curl -sH "Authorization: token ${GITEA_TOKEN}" \
+              "${GITEA_API}/repos/calic/sporel-engine/releases/latest" | \
+              grep -oP '"tag_name":"\K[^"]+')
+          fi
+          ARTEFACT="sporel-engine-${TAG}-${OS_TAG}.zip"
+          mkdir -p engine-release
+          curl -sL -H "Authorization: token ${GITEA_TOKEN}" \
+            -o "engine-release/${ARTEFACT}" \
+            "https://git.davoryn.de/calic/sporel-engine/releases/download/${TAG}/${ARTEFACT}"
+          cd engine-release && unzip "${ARTEFACT}"
+          echo "SPOREL_ROOT=${{ github.workspace }}/engine-release" >> "$GITHUB_ENV"
+      - name: Build
+        run: |
+          cmake -B build -DCMAKE_BUILD_TYPE=${{ inputs.build_type }} -DSPOREL_ROOT=${{ env.SPOREL_ROOT }}
+          cmake --build build --config ${{ inputs.build_type }} --parallel
+
+  package:
+    needs: [lint-lua, build-c]
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Package as zip (multi-OS-pre-built)
+        run: |
+          ARTEFACT="${GITHUB_REPOSITORY##*/}-${GITHUB_REF_NAME}.zip"
+          zip -r "$ARTEFACT" . -x "*.git/*" -x "*.gitea/*" -x "tests/*" -x "build/*"
+          echo "ARTEFACT_NAME=$ARTEFACT" >> "$GITHUB_ENV"
+      - name: Upload to Gitea Release
+        uses: akkuman/gitea-release-action@v1
+        with:
+          files: ${{ env.ARTEFACT_NAME }}