ci(acl): publish the Stryker HTML report as a CI artifact (refs #47)

Add an upload-artifact step to the mutation job so the ACL mutation report is
downloadable from the run summary. `if: always()` uploads it even when the
ratchet fails — exactly when the survivors matter. A glob handles Stryker's
timestamped output directory. First use of actions/upload-artifact (@v4, pinned);
Gitea 1.25.x supports it. Document it in the CI runbook.

Refs #47.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -51,6 +51,15 @@ jobs:
         with:
           dotnet-version: '10.0.x'
       - run: make mutation
+      # Publish the Stryker HTML report. `if: always()` uploads it even when the
+      # ratchet fails — that is exactly when you want to inspect the survivors.
+      # Glob handles Stryker's non-deterministic StrykerOutput/<timestamp>/ dir.
+      - uses: https://github.com/actions/upload-artifact@v4
+        if: always()
+        with:
+          name: acl-mutation-report
+          path: services/acl/StrykerOutput/**/reports/mutation-report.html
+          if-no-files-found: warn
 
   compose-smoke:
     runs-on: ubuntu-latest

docs/runbooks/ci.md

@@ -16,7 +16,7 @@ and CI cannot drift:
 | `lint` | `make lint` → `dotnet format … --verify-no-changes` | .NET 10 SDK |
 | `build` | `make build` → `dotnet build … -c Release` | .NET 10 SDK |
 | `unit` | `make unit` → `dotnet test … -c Release` | .NET 10 SDK |
-| `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL) | .NET 10 SDK |
+| `mutation` | `make mutation` → `dotnet tool restore` → `dotnet stryker` (ACL); uploads the HTML report as an artifact | .NET 10 SDK |
 | `compose-smoke` | `make smoke` → seed config volumes → `up -d` (full stack) → `up --wait` durable services → `down` | container engine + compose v2 |
 
 All `uses:` references are absolute, tag-pinned URLs (`https://github.com/actions/checkout@v4`,
@@ -55,6 +55,14 @@ they gain logic.
 The HTML report is written to `services/acl/StrykerOutput/<timestamp>/reports/` (git-ignored);
 open it to see survived vs. killed mutants.
 
+In CI the `mutation` job publishes that report as the **`acl-mutation-report`** artifact
+(download it from the run's summary page). The upload step uses `if: always()`, so the
+report is available even when the ratchet *fails* — which is exactly when you want to inspect
+the survivors. It is the repo's first use of `actions/upload-artifact` (pinned, `@v4`);
+Gitea ≥1.24 supports v4 and this instance runs 1.25.x. If a future Gitea/runner combination
+can't store artifacts, treat it as a known gap per §15 and record it in
+[gitea-actions-gotchas.md](gitea-actions-gotchas.md) rather than blocking merges on it.
+
 ## Running the stack locally without `make` (Windows / Docker Desktop)
 
 `make` and the bash helpers assume a Unix shell. To bring the whole stack up on a