M2 GATE: green build via push (Drone + exec runner); OAuth bootstrap script + docs

Build #1 success (clone+hello on exec runner). Drone<->Gitea OAuth scripted as
one-time bootstrap-drone-oauth.sh. M2 claimed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

STATUS.md

@@ -1,8 +1,8 @@
 # STATUS — cc-ci Builder
 
-**Phase:** M1 complete & CLAIMED → starting M2 (Drone). M0 PASS (Adversary @21:35Z). M1 awaiting verdict.
-**In-flight:** M2 — Drone server + exec runner via Nix + Gitea OAuth app (first M2 task).
-**Last updated:** 2026-05-26 (M1 claimed)
+**Phase:** M2 complete & CLAIMED → starting M3 (comment bridge). M0+M1 PASS (Adversary). M2 awaiting verdict.
+**In-flight:** M3 — comment-bridge service (!testme webhook → Drone build trigger).
+**Last updated:** 2026-05-26 (M2 claimed, green build #1)
 
 ## Gates
 - **Gate: M0 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: flake rebuilds cc-ci from repo
@@ -16,7 +16,12 @@
   deployed by hand → HTTP 200 over HTTPS via gateway at cchtml1.ci.commoninternet.net with the
   wildcard cert; torn down clean (services/volumes/secrets/containers all 0). Repro:
   `scripts/deploy-proxy.sh` + `abra app new/deploy/undeploy`. Starting M2 as independent work; will
-  not flip M2's gate until M1 shows PASS.
+  not flip M2's gate until M1 shows PASS. → **M1 PASS** @2026-05-26T22:20Z.
+- **Gate: M2 — CLAIMED, awaiting Adversary** (2026-05-26). Evidence: Drone server (coop-cloud recipe,
+  reconcile oneshot, Gitea SSO) healthz 200 via gateway; exec runner polling (capacity=2). cc-ci repo
+  activated (push webhook). Pushing `.drone.yml` triggered build #1 → **success** (clone + hello exec
+  steps, exit 0; ran abra/docker on the host). Repro: `nixos-rebuild switch` + one-time
+  `scripts/bootstrap-drone-oauth.sh`. Starting M3 as independent work; won't flip M3 gate until M2 PASS.
 
 ## Blocked
 - (none)