* Route CI LFS through Gitea * Add fresh Gitea LFS verification mode * Expose fresh LFS verification failures * Avoid duplicate Gitea LFS auth headers