docs(ci): document centralized native verification

.gitea/NATIVE-CI.md

@@ -0,0 +1,15 @@
+# Native CI verification
+
+AppKit is a .NET solution whose tests need a Windows host. Its native verification is **centralized**: this repository
+carries no workflow that selects a host or a runner label.
+
+- The owner-level `native.yaml` in the KofTwentyTwo CI policy repository dispatches the shared `dotnet` profile for
+  `KofTwentyTwo/AppKit` with inputs declared centrally (solution, test projects, coverage packages, platform).
+- It runs on pushes to the protected branches, on manual dispatch, and on pull requests opened from a branch of this same
+  repository. A pull request from a fork never runs on a host: a Linux `fork-deny` job fails it instead.
+- The `native-result` check aggregates the native job. It fails unless the AppKit native job succeeded, so a skipped,
+  failed or cancelled native run cannot pass.
+- The primary `ci-result` check (source/config lint and secrets scan) continues to run on every pull request.
+
+Both `ci-result` and `native-result` are required checks for `main`. Changing what runs, where, or with which inputs is
+done in the CI policy repository, never in a pull request to this repository.

.gitea/workflows/build.yaml

@@ -1,24 +0,0 @@
-name: build
-on:
-  push:
-    branches: ['**']
-    tags: ['v*']
-jobs:
-  windows:
-    uses: self:KofTwentyTwo/ci-workflows/.gitea/workflows/windows.yaml@v1
-    secrets: inherit
-    with:
-      commands: |
-        dotnet restore AppKit.slnx -p:Platform=x64 --locked-mode
-        dotnet build AppKit.slnx -p:Platform=x64 -warnaserror --no-restore
-        # The WinUI sample is built directly so the format workspace can load its generated XAML code.
-        dotnet build samples/AppKit.Sample.WinUI/AppKit.Sample.WinUI.csproj -p:Platform=x64 -warnaserror --no-restore
-        $env:Platform = 'x64'
-        dotnet format AppKit.slnx --verify-no-changes --severity warn --no-restore
-        Remove-Item Env:Platform
-        dotnet test tests/KofTwentyTwo.AppKit.Tests --no-build --settings coverage.runsettings --collect:"XPlat Code Coverage" --logger trx --results-directory TestResults
-        pwsh -NoProfile -File ./build/Assert-Coverage.ps1 -ResultsDirectory TestResults -Packages KofTwentyTwo.AppKit,KofTwentyTwo.AppKit.Updates
-        # A vX.Y.Z tag packs that version; other pushes pack the 0.1.0-dev default.
-        $version = if ($env:GITHUB_REF_TYPE -eq 'tag') { @("-p:Version=$($env:GITHUB_REF_NAME.TrimStart('v'))") } else { @() }
-        dotnet pack AppKit.slnx -c Release -p:Platform=x64 -o artifacts/nuget @version
-      artifacts: artifacts/nuget/*.nupkg