Run Sized Linux checks on the existing Gitea runner

TODO.md

@@ -19,6 +19,9 @@ Keep the existing CLI useful and preserve the GPL-3.0-only license.
 - [x] Commit the scanner hardening and Linux check tooling; push the existing
   `sizequeen-scan-hardening` review branch. Remote equality is verified.
   Open a PR when ready; release/tag/package publication remains separate.
+- [ ] Enable repository Actions and run the same Linux checks on the existing
+  cliff-mads runner. Keep its container isolation and other jobs unchanged;
+  verify a real workflow result before treating CI as proven.
 
 ## Proposed next work
 
@@ -36,6 +39,14 @@ authorized; see `SHIPMENT.md` for source review and the separate release process
 
 ## Resume note
 
+Current CI checkpoint: repository Actions is enabled. The existing cliff-mads
+runner is healthy (`gitea-runner v3.1.0`, native AMD64). The workflow reuses its
+`himesan-node24` label and a separately built Rust/Node image; runner configuration,
+other jobs and repository visibility are unchanged. The image bootstrap probe
+verified UID 65532, workspace-volume ownership, Rust 1.88.0/Node 24.19.0 and
+distinct tmpfs devices. Actual Gitea checkout/check execution is still pending;
+do not call CI proven until the real workflow completes.
+
 Linux validation and the requested remote review branch are complete.
 Scanner hardening is `8b177e2`; repeatable Linux checks and equivalent format
 interpolations are `988aad9`. Both implementation commits are pushed to