fix(ci): pin upload-artifact to @v3 — @v4 refuses to run on Gitea (refs #47)

The artifact step failed the mutation job: upload-artifact@v4 bundles
@actions/artifact v2, which hard-aborts on any non-github.com server ("not
supported on GHES"), even though Gitea 1.25 stores artifacts fine. @v3 uses the
older protocol Gitea speaks and has no GHES guard — a drop-in swap (same inputs).
Document it as gotcha §4 and correct the CI runbook note.

Refs #47.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -54,7 +54,9 @@ jobs:
       # Publish the Stryker HTML report. `if: always()` uploads it even when the
       # ratchet fails — that is exactly when you want to inspect the survivors.
       # Glob handles Stryker's non-deterministic StrykerOutput/<timestamp>/ dir.
-      - uses: https://github.com/actions/upload-artifact@v4
+      # Pinned to @v3 deliberately: @v4 refuses to run on Gitea (GHES guard) —
+      # see docs/runbooks/gitea-actions-gotchas.md §4.
+      - uses: https://github.com/actions/upload-artifact@v3
         if: always()
         with:
           name: acl-mutation-report