runbook: the Gitea webhook now covers the broken poll [skip ci]

Registered as gogs type on all three ArgoCD-tracked repos, secret shared with
argocd-secret's webhook.gogs.secret. Records how to read a failed delivery from
both ends, and that a drifted secret fails validation silently -- which looks
exactly like having no webhook.

RUNBOOK.md

@@ -564,12 +564,33 @@ noticed.** Every "auto-sync" observed on 2026-07-22 happened within seconds of a
 restart, i.e. it was the startup refresh, not the poll. Do not read a successful deploy
 straight after a restart as evidence that polling works.
 
-There is also **no Gitea webhook configured** (`GET /api/v1/repos/gitea_admin/svcforge/hooks`
-returns `[]`, and `argocd-secret` has no `webhook.gitea.secret`), so nothing covers for the
-broken poll. Wiring one is the fix worth making regardless — it turns a 2-3 minute poll into
-an instant push, and it does not depend on the behaviour above being repaired.
+**A webhook now covers for it** (added 2026-07-22, `oci-k8s` `--tags argocd,gitea`). Gitea
+POSTs every push to `https://argocd.oci-oci.duckdns.org/api/webhook`, so a commit refreshes
+ArgoCD in under a second instead of waiting for a poll that never comes.
 
-Until then, a deploy needs a nudge:
+It is registered as Gitea's **`gogs`** type, which looks wrong and is not: ArgoCD's webhook
+handler dispatches on the `X-Gogs-Event` header and ships no Gitea parser. Gitea forked from
+Gogs and still emits that wire format on request. The shared secret lives in
+`argocd-secret` as `webhook.gogs.secret` and in Ansible as `argocd_webhook_secret`; both
+sides must match or every delivery fails signature validation *silently*, which looks
+identical to having no webhook at all.
+
+Check a delivery when a push does not deploy:
+
+```bash
+# Gitea's own record of the last attempt, including the response ArgoCD gave
+curl -s -u "$USER:$PASS" \
+  https://gitea.oci-oci.duckdns.org/api/v1/repos/gitea_admin/svcforge/hooks | jq '.[].id'
+
+# ArgoCD's side
+kubectl -n argocd logs deploy/argocd-server --tail=200 | grep -i webhook
+```
+
+`Unknown webhook event` means the hook type is wrong (it must be `gogs`). A 400 on signature
+means the secrets have drifted — re-run `03_install_addons.yml --tags argocd,gitea`, which
+rewrites both ends from the same variable.
+
+Manual nudge, still valid if the webhook is ever down:
 
 ```bash
 kubectl -n argocd annotate application svcforge argocd.argoproj.io/refresh=normal --overwrite