ci: run CI only on Forgejo and delete the never-run GitHub workflows (WS-D)

The repository has Forgejo and GitLab remotes but no GitHub remote, so
nothing under .github/workflows ever ran - including the daily Payple
renewal job, which means Payple subscriptions were not being renewed.

- Port payple-renew (daily cron + manual dispatch) to Forgejo. Requires the
  Forgejo secrets SUPABASE_URL and CRON_SECRET.
- Port the CI checks (quality incl. version:check and contract:check, build,
  mobile quality, edge functions, API tests) to .forgejo/workflows/ci.yml.
  macOS and Android emulator jobs are dropped: no macOS runner here, and the
  signed Android release stays on GitLab mobile-production-release.
- Keep one site deploy workflow (Linux, Cloudflare Pages); remove the
  manual Windows duplicate. The mobile release boundary self-test runs there.
- Release verifiers read the Forgejo/GitLab workflows, fail if .github
  workflows come back, and check the rewritten site offers no mobile package.

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-7 and W3-8.

scripts/ci/verify-release-metadata.mjs

@@ -33,11 +33,6 @@ function loadSurfaces(readSurface = read) {
     publisher: readSurface('scripts/ci/publish-gitlab-release.mjs'),
     forgejoPublisher: readSurface('scripts/ci/publish-forgejo-release.mjs'),
     gitlab: readSurface('.gitlab-ci.yml'),
-    github: readSurface('.github/workflows/release.yml'),
-    githubMac: readSurface('.github/workflows/build-mac.yml'),
-    githubSigning: readSurface('.github/workflows/release-signing-ca.yml'),
-    forgejoLinux: readSurface('.forgejo/workflows/deploy-site.yml'),
-    forgejoWindows: readSurface('.forgejo/workflows/deploy-site-windows.yml'),
     forgejoRelease: readSurface('.forgejo/workflows/release.yml'),
     changelog: readSurface('CHANGELOG.md'),
   }
@@ -208,7 +203,7 @@ function validate(surfaces) {
 
   for (const [name, workflow] of [
     ['gitlab', surfaces.gitlab],
-    ['github', surfaces.github],
+    ['forgejo', surfaces.forgejoRelease],
   ]) {
     fail(workflow.includes('sync-version.mjs'), `${name}_version_gate_missing`)
     fail(workflow.includes('release/product-version.json'), `${name}_product_metadata_missing`)
@@ -221,10 +216,8 @@ function validate(surfaces) {
   fail(/tags:/.test(surfaces.forgejoRelease), 'forgejo_release_workflow_tag_trigger_missing')
   fail(surfaces.forgejoRelease.includes('sync-version.mjs'), 'forgejo_release_workflow_version_gate_missing')
 
-  fail(!/push:\s*\n\s*tags:/m.test(surfaces.githubMac), 'legacy_mac_tag_trigger_enabled')
-  fail(!/push:\s*\n\s*tags:/m.test(surfaces.githubSigning), 'legacy_signing_tag_trigger_enabled')
-  fail(!surfaces.forgejoLinux.includes('sync-and-publish-forgejo-release'), 'forgejo_linux_legacy_release_sync')
-  fail(!surfaces.forgejoWindows.includes('sync-and-publish-forgejo-release'), 'forgejo_windows_legacy_release_sync')
+  // CI 정본은 Forgejo 한 벌이다(REFACTOR_POLICY W3-7). GitHub 원격이 없어 .github 워크플로는 실행되지 않는다.
+  fail(!existsSync(join(root, '.github/workflows')), 'github_workflows_reintroduced')
   fail(!existsSync(join(root, 'apps/mobile-rn/src/lib/update-manager.ts')), 'unsafe_mobile_update_manager_present')
   fail(
     existsSync(join(root, `apps/mobile-rn/metadata/android/ko-KR/changelogs/${metadata.androidVersionCode}.txt`)),