M2 start: Drone CI decision; Gitea OAuth app + Drone secrets (sops)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -46,7 +46,25 @@ Architecture decisions and dead-ends. One line of rationale each. (§0, §8)
   - **nixpkgs pin:** flake pins the exact rev cc-ci already ran (`50ab793…`) so the first rebuild
     is a true no-op-then-base. Bump deliberately, never drift.
 - **Webhook scope:** default per-repo via enroll script.
-- **Drone runner type:** default exec (must drive host abra).
+- **CI engine: Drone (per plan) — kept, with a noted risk.** nixpkgs 24.11 has Drone **server**
+  2.24.0 but `drone-runner-exec` is **abandoned (unstable-2020-04-19)** — the only exec runner Drone
+  ever shipped (upstream archived ~2021). The maintained fork **Woodpecker** (2.7.3, with NixOS
+  modules) is the alternative. Decision: honor the plan (Drone) because the plan is Drone-specific
+  (D7 "Drone's native UI", comment-bridge → Drone API). The 2020 exec runner pairs fine with modern
+  Drone server (RPC protocol stable). **Fallback:** if the exec runner proves incompatible/broken,
+  pivot to Woodpecker (coop-cloud ships a `woodpecker` recipe too) and record it — like the traefik
+  pivot. Re-evaluate at the M2 gate.
+- **Drone deployment shape — SETTLED (M2):** mirror the traefik pattern. The **server** is the
+  coop-cloud `drone` recipe (drone/drone:2.26.0) deployed via abra (swarm-native, auto-routed by
+  traefik at `drone.ci.commoninternet.net`, `LETS_ENCRYPT_ENV` empty → wildcard cert, no ACME),
+  with Gitea SSO (`compose.gitea.yml`). The **exec runner** runs as a Nix systemd service on the
+  host (`modules/drone-runner.nix`) so it can drive host abra/swarm (plan §4.2). One generated
+  `DRONE_RPC_SECRET` is shared: inserted as the server's `rpc_secret` swarm secret AND read by the
+  runner from sops. Reproducible deploy: `scripts/deploy-drone.sh`.
+  - Gitea OAuth app `cc-ci-drone` created under the bot (client_id `ab4cdb9d-ee96-4867-875f-
+    87384505fc52`, redirect `https://drone.ci.commoninternet.net/login`); client_secret +
+    rpc_secret stored sops-encrypted in `secrets/secrets.yaml` (A2 internal secrets).
+- **Drone runner type:** exec (must drive host abra).
 - **Secret tool — SETTLED (M0):** sops-nix. cc-ci decrypts at activation using its **ed25519 SSH
   host key** as the age identity (`sops.age.sshKeyPaths`), so no extra key file to manage on the box.
   Recipients in `/.sops.yaml`: the host age key (`age1h90ut…`, from ssh-to-age) + an off-box