Run the gate, the editor suite and the three games on the Gitea runner

The job image (tools/ci/Dockerfile, label game-maker-ci) carries chromium with the Vulkan
drivers, php-cli and the host's fonts; the render device itself comes from the runner's
container.options, so a job container gets the Intel GPU instead of llvmpipe.

tools/ci/serve.sh puts the checkout behind /game-maker/ with php -S and writes the project
shells the seeders need; every tool now takes its server from GAME_MAKER_BASE_URL rather than
from a project id repeated in shell scripts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tools/ci/project-shells.mjs

@@ -0,0 +1,29 @@
+#!/usr/bin/env node
+/**
+ * Creates the empty project files the seeders write into. `PUT ?r=projects/{id}` does not create
+ * a project and `POST` hands out a random id, so a fresh CI checkout has to put the shells with
+ * the known ids in place itself. The playground is left out – no tool may touch it.
+ *
+ * Usage: node tools/ci/project-shells.mjs [dataDir]
+ */
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PROJECTS } from '../lib/projects.mjs';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
+const dir = process.argv[2] ?? resolve(root, 'data/projects');
+
+await mkdir(dir, { recursive: true });
+for (const [name, id] of Object.entries(PROJECTS)) {
+  if (name === 'playground') continue;
+  const doc = {
+    id,
+    name,
+    revision: 0,
+    updatedAt: '1970-01-01T00:00:00Z',
+    project: {},
+  };
+  await writeFile(resolve(dir, `${id}.json`), `${JSON.stringify(doc)}\n`);
+  console.log(`shell ${name} ${id}`);
+}