M2 GATE: green build via push (Drone + exec runner); OAuth bootstrap script + docs

Build #1 success (clone+hello on exec runner). Drone<->Gitea OAuth scripted as
one-time bootstrap-drone-oauth.sh. M2 claimed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

BACKLOG.md

@@ -26,9 +26,12 @@ Two single-writer sections (§6.1): Builder edits only `## Build backlog`; Adver
       CLAIMED 2026-05-26, awaiting Adversary.
 
 ### M2 — Drone online
-- [ ] Drone server + exec runner via Nix; Gitea OAuth app
-- [ ] hello-world .drone.yml runs green; logs in Drone UI
-- [ ] Gate: M2 — push to cc-ci triggers visible green build
+- [x] Drone server (coop-cloud recipe, reconcile oneshot) + exec runner via Nix; Gitea OAuth app.
+      Server healthz 200 via gateway; runner polling (capacity=2, type=exec).
+- [x] hello-world .drone.yml runs green; logs visible (Drone UI + API). Build #1 success: clone +
+      hello (echo/whoami=root/abra 0.13.0-beta/swarm=active), both exit 0.
+- [x] Gate: M2 — push to cc-ci triggers visible green build → CLAIMED 2026-05-26, awaiting Adversary.
+      OAuth link via one-time `scripts/bootstrap-drone-oauth.sh` (documented in install.md §2).
 
 ### M3 — Comment bridge
 - [ ] comment-bridge service: HMAC verify, !testme exact match, collaborator check, Drone API call