Seed the shared CI tools

Split out of the four repos per weblib-archive#44. All three files were
byte-identical across every repo at this moment, which will not stay true --
they converged only because four twin PRs landed within hours today, and
report_job_log.py had already drifted once before that.

Taken from weblib-archive, verified identical to every other copy first:

  with-nixpkgs.sh       ca43fa20  (cfbypass, archive, fs)
  report_job_log.py     aaef8f62  (cfbypass, archive)
  sync_blocked_label.py e6ddb21d  (all four)

action.yml is included so the `uses:` question can be re-measured now the repo
is public; it did not work while private.

Co-authored-by: bit <bit@das-labor.org>

with-nixpkgs.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+#
+# Run a command with one nixpkgs package on PATH, taken from *this repo's*
+# flake.lock.
+#
+#     bash .gitea/with-nixpkgs.sh python3 python3 tools/sync_blocked_label.py …
+#     bash .gitea/with-nixpkgs.sh openssh nix build .#checks.x86_64-linux.tests
+#
+# **Call it as `bash <script>`, not `<script>`.** The runner has no
+# `/usr/bin/env`, so the shebang cannot be relied on there:
+#
+#     .gitea/with-nixpkgs.sh: /usr/bin/env: bad interpreter: No such file or directory
+#
+# The shebang stays for running it by hand on a normal machine. `run:` steps
+# already execute under bash, so naming the interpreter costs nothing.
+#
+# ## Why not `nix shell nixpkgs#python3`
+#
+# That is a *registry* reference. It resolves the indirect `nixpkgs` entry to
+# whatever the branch points at now, so whenever that moves the runner fetches
+# a fresh channel tarball and evaluates it cold -- caught in the act in a job
+# log:
+#
+#     unpacking 'https://channels.nixos.org/nixpkgs-unstable/nixexprs.tar.xz'
+#     into the Git cache...
+#
+# for a job that wanted one binary.
+#
+# ## Why not a `packages.python3` flake output
+#
+# It was that first, and bit's review of cfbypass#22 asked for pipeline things
+# to live under `.gitea/` rather than in the flake. That is also the only form
+# that works everywhere: evaluating *any* output of weblib-archive's flake
+# forces its inputs, one of which is `cfbypass` over ssh -- which the runner
+# cannot fetch. This script never evaluates the project flake, only the lock
+# file, so the same line works in every repo.
+#
+# The rev comes from flake.lock, so it cannot drift the way a rev hardcoded in
+# YAML would, and it is the same nixpkgs the test job instantiates -- one store
+# path, not two.
+set -euo pipefail
+
+if [ "$#" -lt 2 ]; then
+  echo "usage: $0 <nixpkgs attribute> <command> [args...]" >&2
+  exit 2
+fi
+
+attr=$1
+shift
+
+# --impure because the expression reads a path relative to the working
+# directory. It only reads flake.lock; nothing is fetched to find the rev.
+rev=$(nix eval --raw --impure \
+  --expr '(builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked.rev')
+
+exec nix shell "github:nixos/nixpkgs/${rev}#${attr}" --command "$@"