Use verified self-hosted Actions snapshots for NAS Runner reliability

.github/workflows/verify.yml

@@ -18,8 +18,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
+      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
         with:
           python-version: '3.14'
       - name: Install CI dependencies with index diagnostics and fallback
@@ -66,8 +66,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: https://gitea.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: https://gitea.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
+      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
         with:
           python-version: '3.14'
       - name: Install deploy tooling

docs/deployment/GITEA_CD.md

@@ -274,11 +274,25 @@ real host mounts and restart, remains the required live acceptance.
 
 ## Actions download transport
 
-Verify and deploy use explicitly addressed, commit-pinned actions from
-`https://gitea.com/actions/checkout` (v4) and
-`https://gitea.com/actions/setup-python` (v5). This avoids the Runner default
-GitHub action discovery transport, which failed with EOF/timeouts in runs 27/28.
-All validation steps are unchanged. Python toolcache misses may still require
-setup-python to download Python from its upstream release source; this change
-does not claim to eliminate every external download. Action commits should be
-reviewed and intentionally updated, not silently replaced by mutable mirror tags.
+Verify and deploy fetch commit-pinned Actions from the supporting repository
+`https://tea.pigway.com/way/frame-flow-ci-actions`, subdirectories `checkout`
+and `setup-python`, at commit `bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46`.
+This avoids unstable NAS downloads from GitHub (EOF/timeouts in runs 27/28)
+and slow external Gitea Action preparation (run 29, superseded).
+
+The cache contains unmodified official upstream source, including MIT licenses:
+
+| Action | Official upstream commit | Identical Git tree |
+| --- | --- | --- |
+| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 | f8a7b72dc00648d050099727d25ca92a43ad1162 |
+| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 | 568c6310706725a8b725497dbe6b3b909cbcf6cd |
+
+`UPSTREAM.json` records provenance. Upstream tag SHAs were checked using the official
+GitHub API; each cached subtree hash was compared to the upstream commit tree.
+No application secrets are stored in this public upstream-source cache; its own
+Actions are disabled. Intentional action updates must repeat tree verification
+and change the workflow pin. All validation steps remain unchanged.
+
+Python toolcache misses may still require setup-python to download Python from
+its upstream release source. This removes Action source download dependence,
+not every possible external download. No Runner or NAS network configuration is changed.