fix(ci): pin upload-artifact to @v3 — @v4 refuses to run on Gitea (refs #47)

The artifact step failed the mutation job: upload-artifact@v4 bundles
@actions/artifact v2, which hard-aborts on any non-github.com server ("not
supported on GHES"), even though Gitea 1.25 stores artifacts fine. @v3 uses the
older protocol Gitea speaks and has no GHES guard — a drop-in swap (same inputs).
Document it as gotcha §4 and correct the CI runbook note.

Refs #47.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/runbooks/ci.md

@@ -58,10 +58,10 @@ open it to see survived vs. killed mutants.
 In CI the `mutation` job publishes that report as the **`acl-mutation-report`** artifact
 (download it from the run's summary page). The upload step uses `if: always()`, so the
 report is available even when the ratchet *fails* — which is exactly when you want to inspect
-the survivors. It is the repo's first use of `actions/upload-artifact` (pinned, `@v4`);
-Gitea ≥1.24 supports v4 and this instance runs 1.25.x. If a future Gitea/runner combination
-can't store artifacts, treat it as a known gap per §15 and record it in
-[gitea-actions-gotchas.md](gitea-actions-gotchas.md) rather than blocking merges on it.
+the survivors. It is the repo's first use of `actions/upload-artifact`, pinned to **`@v3`**:
+`@v4` refuses to run on Gitea (its `@actions/artifact` v2 library blocks any non-github.com
+server as "GHES"), while `@v3` speaks the artifact protocol Gitea implements. See
+[gitea-actions-gotchas.md §4](gitea-actions-gotchas.md) (§15).
 
 ## Running the stack locally without `make` (Windows / Docker Desktop)