build: the cloud frontend stands alone

The Durable Object, the sandbox daemon, and their deploy assets
leave the rhema workspace for a repository of their own. The DO
was already a deployment artifact (publish = false, worker feature
wasm-only), and rhema-sandbox-server's only consumer was the image
beside it — both are product, not framework. The harness and the
seam stay behind: rhema-cloud-agent and the sandbox family join
the rhema repository's publish list, and this tree consumes them
from crates.io at 0.2.6, the same arrangement the claw keeps its
framework crates under.

The sandboxd image build carries the fix its extraction needed:
the old Dockerfile still staged the claw's workspace (claw and
tools manifests, integrations globs, the vendored crossterm) and
missed rhema-provider-registry's manifest entirely. The manifest
stage is now this workspace's two members, fetched from the
registry.

Not yet buildable: the rhema 0.2.6 batch (rhema-sandbox,
-local, -http, rhema-cloud-agent) must publish first — then one
cargo check generates Cargo.lock and CI goes green.

.gitea/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: ci
+
+on:
+  push:
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  # Fast checks + release build of the workspace.
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      # Installs the toolchain pinned in rust-toolchain.toml.
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      - name: Format
+        run: cargo fmt --all -- --check
+
+      # No system OpenSSL in this graph: the daemon builds without it,
+      # and the dev reqwest rides rustls (the runner's gcc covers the
+      # C sources rustls compiles).
+      - name: Clippy (warnings are errors)
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+      - name: Build (release)
+        run: cargo build --release --workspace
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+
+      # The loopback test drives the daemon with the real client over
+      # the real wire; the DO's neutral half tests host-side without
+      # the worker feature. No test talks to the network.
+      - name: Test
+        run: cargo test --workspace --all-features
+
+  # The DO compiles to wasm32: the worker feature is the real build,
+  # and the platform-neutral half must also stay wasm-clean without
+  # it — workerd is the one host that provides the bindings.
+  wasm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://gitea.com/actions/checkout@v4
+
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          target: wasm32-unknown-unknown
+
+      - name: Check the Durable Object build
+        run: cargo check -p rhema-cloudflare-code --target wasm32-unknown-unknown --features worker
+
+      - name: Check the platform-neutral half
+        run: cargo check -p rhema-cloudflare-code --target wasm32-unknown-unknown --no-default-features