ci: 让测试真的跑起来（Gitea Actions + pre-push 钩子）

`node --test tests/` 在 Node 22 上根本不工作 —— Node 把路径当模块加载，
报 "Cannot find module .../tests"，退出码 1，零个测试执行。而这条命令在
CLAUDE.md 里被当作标准用法记了很久。这大概就是这套断言从来没人跑起来的
一个主要原因：照文档敲，得到一个看不懂的错误。

正确形式是裸 `node --test`（自动发现 **/*.test.mjs）。四处全改，并加断言
钉住 —— 我自己第一版钩子和 workflow 也照抄了那个错误形式，实测才发现
它会无条件拦住每一次 push。

- .gitea/workflows/tests.yml：Gitea 原生位置。用 node 容器而非 setup-node，
  自建 Gitea 上后者要从 GitHub 拉，是新 runner 上又一个可能缺的东西。
  容器 tag 与 NODE_VERSION 绑定，否则 CI 测的运行时和出货的不是一个。
- .github/workflows/tests.yml：镜像一份，断言保证两边执行内容一致。
- .githooks/pre-push：不依赖任何 runner 的兜底。实测过它会拦下失败的 push。
  写明 --no-verify 怎么跳过 —— 拦不掉的钩子会被第一个被卡住的人删掉。

为什么需要钩子这一层：这台 Gitea 的 Actions 是开着的，但推上去的 workflow
产生了 0 次运行（total_count: 0），runner API 要鉴权查不了，最可能是没注册
runner。钩子是唯一完全不需要服务端支持的一层。

CLAUDE.md 补上 `git config core.hooksPath .githooks` —— 钩子是 per-clone 的，
没人替你装。

tests/ci-parity.test.mjs

@@ -0,0 +1,89 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+const repoRoot = fileURLToPath(new URL('..', import.meta.url));
+const read = (...parts) => readFileSync(join(repoRoot, ...parts), 'utf8');
+
+// The suite went unrun for the whole life of the upstream project: nothing
+// invoked `node --test`, so every assertion in tests/ was decoration. These
+// checks are about the machinery that runs the tests, not the product.
+
+test('the workflow exists in both places Gitea might scan', () => {
+  // Which location a Gitea instance picks up depends on its config, and we
+  // cannot verify the server's config from here.
+  for (const path of [['.gitea', 'workflows', 'tests.yml'], ['.github', 'workflows', 'tests.yml']]) {
+    assert.ok(existsSync(join(repoRoot, ...path)), `${path.join('/')} is missing`);
+  }
+});
+
+test('both copies of the workflow run the same thing', () => {
+  const steps = (yaml) =>
+    [...yaml.matchAll(/^\s+run:\s*(.+)$/gm)].map((m) => m[1].trim());
+  const gitea = steps(read('.gitea', 'workflows', 'tests.yml'));
+  const github = steps(read('.github', 'workflows', 'tests.yml'));
+  assert.deepEqual(gitea, github, 'the two workflow copies have drifted apart');
+  // Bare `node --test`, not `node --test tests/` — see the assertion below.
+  assert.ok(gitea.some((s) => /node --test\s*$/.test(s)), 'neither copy actually runs the tests');
+  assert.ok(gitea.some((s) => s.includes('--check')), 'neither copy checks the generated files');
+});
+
+test('the workflow does not depend on a runner fetching setup actions', () => {
+  // On a self-hosted Gitea, setup-node has to be pulled from GitHub. A node
+  // container removes one thing that can be missing on a fresh runner.
+  const yaml = read('.gitea', 'workflows', 'tests.yml');
+  // Comments discuss setup-node on purpose; only the steps matter.
+  const steps = yaml.split(/\r?\n/).filter((line) => !line.trim().startsWith('#')).join('\n');
+  assert.doesNotMatch(steps, /setup-node/, 'prefer a node container over setup-node here');
+  assert.match(steps, /image:\s*node:/, 'the job should run in a node container');
+
+  // The container tag has to match what we pin, or CI tests a different runtime
+  // than the product ships.
+  const pinned = read('NODE_VERSION').trim().replace(/^v/, '');
+  assert.match(
+    steps,
+    new RegExp(`image:\\s*node:${pinned.replace(/\./g, '\\.')}`),
+    `the container should be node:${pinned} to match NODE_VERSION`,
+  );
+});
+
+test('a pre-push hook backs CI up, and says how to skip it', () => {
+  const hook = read('.githooks', 'pre-push');
+  assert.match(hook, /node --test tests\//, 'the hook should run the suite');
+  assert.match(hook, /build-messages\.mjs --check/, 'the hook should catch stale generated files');
+  // A hook that cannot be bypassed gets deleted by the first person it blocks
+  // at a bad moment.
+  assert.match(hook, /--no-verify/, 'the hook should document how to skip it');
+  // It must not pretend to have passed when node is unavailable.
+  assert.match(hook, /skipping tests/, 'the hook should say so when it cannot run');
+});
+
+test('the hook is documented where someone cloning will see it', () => {
+  // A hook nobody installs protects nobody. core.hooksPath is per-clone.
+  const claude = read('CLAUDE.md');
+  assert.match(claude, /core\.hooksPath/, 'CLAUDE.md should say how to enable the hook');
+});
+
+test('nothing invokes the form of node --test that does not work', () => {
+  // `node --test tests/` makes Node load the path as a module: "Cannot find
+  // module .../tests", exit 1, zero tests run. It was the documented command in
+  // CLAUDE.md for the life of the project — which is a good part of why the
+  // suite went unrun. Bare `node --test` discovers **/*.test.mjs correctly.
+  const offenders = [];
+  for (const path of [
+    ['.githooks', 'pre-push'],
+    ['.gitea', 'workflows', 'tests.yml'],
+    ['.github', 'workflows', 'tests.yml'],
+    ['CLAUDE.md'],
+  ]) {
+    read(...path).split(/\r?\n/).forEach((line, i) => {
+      // A bare directory argument. Naming a specific .mjs file is fine.
+      if (/node --test\s+tests\/\s*($|[>|&])/.test(line)) {
+        offenders.push(`${path.join('/')}:${i + 1}`);
+      }
+    });
+  }
+  assert.deepEqual(offenders, [], `these run a form that executes nothing:\n${offenders.join('\n')}`);
+});