Seed the shared CI tools

Split out of the four repos per weblib-archive#44. All three files were
byte-identical across every repo at this moment, which will not stay true --
they converged only because four twin PRs landed within hours today, and
report_job_log.py had already drifted once before that.

Taken from weblib-archive, verified identical to every other copy first:

  with-nixpkgs.sh       ca43fa20  (cfbypass, archive, fs)
  report_job_log.py     aaef8f62  (cfbypass, archive)
  sync_blocked_label.py e6ddb21d  (all four)

action.yml is included so the `uses:` question can be re-measured now the repo
is public; it did not work while private.

Co-authored-by: bit <bit@das-labor.org>

README.md

@@ -1,2 +1,53 @@
 # weblib-ci
 
+The CI scripts shared by [cfbypass], [weblib-archive], [weblib-fs] and
+[weblib-viewer]. Split out per weblib-archive#44, where they had been
+hand-copied into each repo and had already drifted once.
+
+**Public deliberately.** Nothing here is a secret or specific to the archive's
+contents: a nixpkgs-pinning wrapper, a log poster and a label reconciler.
+Public means a consumer needs no deploy key, no ssh setup and no secret to
+fetch it — which was measured to be the difference between one step and three.
+
+## What is here
+
+| file | what it does |
+|---|---|
+| `with-nixpkgs.sh` | Runs a command with one nixpkgs package on PATH, pinned to the *consuming* repo's `flake.lock`. Avoids `nix shell nixpkgs#x`, which re-resolves the registry and refetches a channel tarball whenever the branch moves. |
+| `report_job_log.py` | Posts the tail of a build log as a PR comment. Exists because `actions/jobs/{id}/logs` returns 500 for every id on Gitea 1.25.2, so a red job otherwise says only that it failed. |
+| `sync_blocked_label.py` | Keeps `Status/Blocked` in step with Gitea's dependency graph. |
+
+All three are standard library / plain bash only. They are *run*, not built, so
+this repo has no flake.
+
+## Using it
+
+`with-nixpkgs.sh` reads the **consuming** repo's `flake.lock` relative to the
+working directory, so it keeps working from a subdirectory.
+
+```yaml
+- uses: actions/checkout@v4
+- name: fetch the shared CI tools
+  run: git clone --depth 1 https://git.chaosbit.de/weblib/weblib-ci.git .ci
+- run: bash .ci/with-nixpkgs.sh python3 python3 .ci/report_job_log.py /tmp/build.log
+```
+
+No credentials: the repo is public, which is the whole point of it being so.
+
+### Why not `uses:`
+
+`uses:` pointing at a repo on this instance was measured on weblib-archive#44
+and did not work, in either the bare `weblib/weblib-ci@main` form or with a
+full URL — while a plain clone with the same access did. `action.yml` is kept
+here so the question can be re-checked cheaply if the instance changes; the
+README records the answer so nobody has to re-derive it.
+
+### Why not a flake input
+
+These are scripts a workflow runs, not derivations. A flake input would cost a
+`flake.lock` bump in four repos every time one changes, and buys nothing.
+
+[cfbypass]: https://git.chaosbit.de/weblib/cfbypass
+[weblib-archive]: https://git.chaosbit.de/weblib/weblib-archive
+[weblib-fs]: https://git.chaosbit.de/weblib/weblib-fs
+[weblib-viewer]: https://git.chaosbit.de/weblib/weblib-viewer