docs: the server runs Gitea 1.27.2, not 1.24.2; say what it actually honours

The CI documentation, the workflow header, the README, ADR 0047 and the
sweep's comment all said the server was Gitea 1.24.2, which ignores
`permissions`, `concurrency` and `timeout-minutes`. The server reports
1.27.2 (GET /api/v1/version).

Each claim is now stated from what is verified on this server:
- `concurrency` is honoured, observed: Ekklesia runs 133 and 135 were
  cancelled when a newer run started for the same pull request;
- `permissions` is supported by 1.27 with Gitea's own scopes, but the
  token's actual authority is not visible through the API and not yet
  proven, so nothing claims the job token is read-only;
- `timeout-minutes` is no longer listed as unsupported, but is not
  verified, and teardown still relies on the stack sweep and a reaper.

Requirement 1 for executing untrusted contributions (upgrade to the
1.26 line or later) is marked done; items 2 and 3, configuring and
proving token authority, remain. ADR 0047 (still Proposed) restates
its "docker run, not a reusable workflow" reasons for 1.27, where
private sources are supported. The reasons still hold without the 1.24
argument.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -218,9 +218,10 @@ undeployed state, and the launch checklist in a single place. **CI is accepted a
 trusted-code-only boundary**: the self-hosted Gitea runner executes only code controlled and
 reviewed by trusted repository collaborators, and unknown or untrusted pull requests must not
 execute on it automatically. What remains is operational and cannot be proven from this repository —
-upgrading Gitea past 1.24.2 (which *ignores* the workflow's `permissions`, `concurrency`, and
-`timeout-minutes` declarations), clamping job-token authority server-side, enforcing timeout and
-teardown in a trusted provisioner/reaper, and proving disposable runner isolation. Those are
+configuring and proving job-token authority server-side (the server now runs Gitea 1.27.2, which
+honours `concurrency` and documents `permissions`, but neither token limits nor `timeout-minutes` are
+verified on it yet), enforcing timeout and teardown in a trusted provisioner/reaper, and proving
+disposable runner isolation. Those are
 prerequisites for **executing untrusted contributions**, alongside the deployment checklist that
 gates a **public launch**; moving future public contribution workflows to a service with isolated
 hosted runners is an acceptable alternative. **Neither set of requirements blocks Phase 6** — Surface