fix: address PR #75 review findings

MAJOR fixes:
- ci.yml: Add fork protection (github.event.pull_request.head.repo.full_name check)
  to prevent secret exfiltration from malicious fork PRs. Added security comment
  explaining the trust model for this private repo.
- ci.yml: Set GITHUB_SERVER_URL to explicit Gitea URL instead of github.server_url
  since reviews are posted to Gitea, not GitHub.
- release.yml: Set GITEA_URL explicitly to https://gitea.weiker.me since releases
  are created on Gitea.
- action.yml: Change gitea-url default from empty (fallback to github.server_url)
  to explicit https://gitea.weiker.me. Update all internal uses to rely on this
  default rather than falling back to server_url.

MINOR fixes:
- action.yml: Update header comment to reflect dual-platform (Gitea Actions +
  GitHub Actions) support.
- action.yml: Fix repo input description to say it defaults to rodin/review-bot
  for version lookup, matching the actual code behavior.
- pr-ready-gate.yml: Add comments explaining why Gitea URL is hardcoded (intentional:
  we update Gitea PR from GitHub mirror) and noting the PR number matching assumption.

All findings from sonnet-review, gpt-review, and security-review addressed.

.github/workflows/ci.yml

@@ -22,9 +22,13 @@ jobs:
   # Models must match SAP AI Core deployments
   # Available models: gpt-5, anthropic--claude-4.6-sonnet, anthropic--claude-4.6-opus
   # Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
+  #
+  # SECURITY: This job runs on pull_request and has access to secrets.
+  # We restrict to same-repo PRs only (no forks) since this is a private repo
+  # where PRs only come from trusted actors (rodin/aweiker).
   review:
     runs-on: ubuntu-24.04
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     needs: test
     strategy:
       matrix:
@@ -49,8 +53,9 @@ jobs:
       - run: go build -o review-bot ./cmd/review-bot
       - name: Run ${{ matrix.name }} review
         env:
-          GITHUB_SERVER_URL: ${{ github.server_url }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
+          # Use Gitea API - reviews are posted to Gitea, not GitHub
+          GITHUB_SERVER_URL: https://gitea.weiker.me
+          GITHUB_REPOSITORY: rodin/review-bot
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REVIEWER_TOKEN: ${{ secrets[matrix.token_secret] }}
           REVIEWER_NAME: ${{ matrix.name }}