- Replace actions/checkout (pulls from github.com) with scripts/ci_checkout.sh fetched from this Gitea over raw/commit. - Remove the macOS job (no runner). - Disable sanitizers until the Docker runner has SYS_PTRACE; it was wedging the only slot with AddressSanitizer:DEADLYSIGNAL. - Add windows-cross: Nix UCRT mingw via TUNA, bootstrap_windows.sh, verify dist/cst-agent-*-windows-x86_64.zip. Third-party git clones go through gitclone.com.