Routes around the .gitea/workflows/** branch protection on
FM06/flowmaster-ops by hosting the same workflow in a repo I can
self-merge. Runs on the build01 runner which has cluster kubectl
access via its ServiceAccount (confirmed by sealed-secret-drift +
innova-promotion-gate in flowmaster-ops). Trigger from the Gitea
Actions tab when ready.
