diag: add minimal Forgejo Actions diagnostic workflow

Probes the runner setup so we can tell whether the release.yml
failure is upstream of our workflow (no runner, no network, no
tooling) or specific to a step.

- Container reachable + image usable
- DNS + outbound HTTPS to forgejo.pschneider.fr and hub.docker.com
- Required tooling available (git, dotnet, jq, curl, make, debhelper,
  imagemagick)
- forgejo.* context populated
- secrets.GITHUB_TOKEN resolves (FORGEJO_TOKEN populated)
- API call with the token returns 200 on /repos/<repo>

Will be removed once we've confirmed the runner is healthy.

.forgejo/workflows/diag.yml

@@ -0,0 +1,74 @@
+name: diag
+
+# Diagnostic minimal : vérifie que le runner Forgejo démarre, qu'il
+# peut cloner, et qu'il a accès à Internet + Docker (pour le label
+# docker:// sur lequel tournent nos jobs).
+#
+# À supprimer une fois qu'on a confirmé que le runner est OK.
+
+on:
+  workflow_dispatch:
+
+jobs:
+  diag:
+    runs-on: docker
+    container:
+      image: docker.io/pazof/yavsc-build-env:debian12-dotnet10-android36-v2
+    steps:
+      - name: Hello
+        run: |
+          echo "Runner started, container is alive."
+          echo "Image: $(cat /etc/os-release | grep PRETTY_NAME)"
+          echo "Hostname: $(hostname)"
+          echo "User: $(whoami)"
+          echo "Working dir: $(pwd)"
+
+      - name: Network check
+        run: |
+          echo "--- DNS resolution ---"
+          getent hosts forgejo.pschneider.fr || echo "FAIL: cannot resolve forgejo.pschneider.fr"
+          echo "--- HTTP outbound ---"
+          curl -sS -o /dev/null -w "forgejo.pschneider.fr HTTP %{http_code} (%{time_total}s)\n" \
+            https://forgejo.pschneider.fr/ || echo "FAIL: cannot reach forgejo.pschneider.fr"
+          echo "--- Docker Hub ---"
+          curl -sS -o /dev/null -w "hub.docker.com HTTP %{http_code}\n" \
+            https://hub.docker.com/ || echo "FAIL: cannot reach hub.docker.com"
+
+      - name: Tooling check
+        run: |
+          echo "--- git ---"
+          git --version
+          echo "--- dotnet ---"
+          dotnet --info | head -5
+          echo "--- jq ---"
+          jq --version
+          echo "--- curl ---"
+          curl --version | head -1
+          echo "--- make ---"
+          make --version | head -1
+          echo "--- debhelper ---"
+          which dh || echo "FAIL: dh not found (debhelper absent)"
+          echo "--- imagemagick ---"
+          which convert || echo "FAIL: convert not found"
+
+      - name: Forgejo context probe
+        env:
+          FORGEJO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        run: |
+          echo "--- forgejo.* context ---"
+          echo "forgejo.ref_name=[${{ forgejo.ref_name }}]"
+          echo "forgejo.repository=[${{ forgejo.repository }}]"
+          echo "forgejo.api_url=[${{ forgejo.api_url }}]"
+          echo "--- secrets.GITHUB_TOKEN probe ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            echo "FORGEJO_TOKEN is set (length=${#FORGEJO_TOKEN})"
+          else
+            echo "FORGEJO_TOKEN is EMPTY — secrets.GITHUB_TOKEN did not resolve"
+          fi
+          echo "--- API reachability via FORGEJO_TOKEN ---"
+          if [[ -n "$FORGEJO_TOKEN" ]]; then
+            HTTP=$(curl -sS -o /dev/null -w '%{http_code}' \
+              -H "Authorization: token $FORGEJO_TOKEN" \
+              "${{ forgejo.api_url }}/repos/${{ forgejo.repository }}")
+            echo "GET /repos/${{ forgejo.repository }} -> HTTP $HTTP"
+          fi