feat: add phases 10-11, enhance phase 8 direct-check mode, and update Caddy migration

- Phase 10: local repo cutover (rename origin→github, add Gitea remote, push branches/tags)
- Phase 11: custom runner infrastructure with toolchain-based naming
  (go-node-runner, jvm-android-runner) and repo variables via Gitea API
- Add container_options support to manage_runner.sh for KVM passthrough
- Phase 8: add --allow-direct-checks flag for LAN/split-DNS staging
- Phase 7.5: add Cloudflare TLS block, retry logic for probes, multi-upstream support
- Add toggle_dns.sh helper and update orchestration scripts for phases 10-11

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

phase10_post_check.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase10_post_check.sh — Verify local repo remote cutover to Gitea
+# Checks for each discovered local repo:
+#   1. origin points to Gitea org/repo
+#   2. github points to GitHub owner/repo
+#   3. every local branch tracks origin/<branch>
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+source "${SCRIPT_DIR}/lib/phase10_common.sh"
+
+load_env
+require_vars GITEA_ORG_NAME GITEA_DOMAIN GITHUB_USERNAME
+
+phase_header 10 "Local Repo Remote Cutover — Post-Check"
+
+LOCAL_REPO_ROOT="${PHASE10_LOCAL_ROOT:-/Users/s/development}"
+EXPECTED_REPO_COUNT="${PHASE10_EXPECTED_REPO_COUNT:-3}"
+
+for arg in "$@"; do
+  case "$arg" in
+    --local-root=*) LOCAL_REPO_ROOT="${arg#*=}" ;;
+    --expected-count=*) EXPECTED_REPO_COUNT="${arg#*=}" ;;
+    --help|-h)
+      cat <<EOF
+Usage: $(basename "$0") [options]
+
+Options:
+  --local-root=PATH      Root folder containing local repos (default: /Users/s/development)
+  --expected-count=N     Require exactly N discovered repos (default: 3, 0 disables)
+  --help                 Show this help
+EOF
+      exit 0
+      ;;
+    *)
+      log_error "Unknown argument: $arg"
+      exit 1
+      ;;
+  esac
+done
+
+if ! [[ "$EXPECTED_REPO_COUNT" =~ ^[0-9]+$ ]]; then
+  log_error "--expected-count must be a non-negative integer"
+  exit 1
+fi
+
+if ! phase10_discover_local_repos "$LOCAL_REPO_ROOT" "$GITHUB_USERNAME" "$SCRIPT_DIR" "$EXPECTED_REPO_COUNT"; then
+  exit 1
+fi
+
+PASS=0
+FAIL=0
+
+for i in "${!PHASE10_REPO_NAMES[@]}"; do
+  repo_name="${PHASE10_REPO_NAMES[$i]}"
+  repo_path="${PHASE10_REPO_PATHS[$i]}"
+  github_url="${PHASE10_GITHUB_URLS[$i]}"
+  gitea_url="$(phase10_canonical_gitea_url "$GITEA_DOMAIN" "$GITEA_ORG_NAME" "$repo_name")"
+
+  log_info "--- Checking repo: ${repo_name} (${repo_path}) ---"
+
+  origin_url="$(git -C "$repo_path" remote get-url origin 2>/dev/null || true)"
+  if [[ -n "$origin_url" ]] && phase10_url_is_gitea_repo "$origin_url" "$GITEA_DOMAIN" "$GITEA_ORG_NAME" "$repo_name"; then
+    log_success "origin points to Gitea (${gitea_url})"
+    PASS=$((PASS + 1))
+  else
+    log_error "FAIL: origin does not point to ${gitea_url} (found: ${origin_url:-<missing>})"
+    FAIL=$((FAIL + 1))
+  fi
+
+  github_remote_url="$(git -C "$repo_path" remote get-url github 2>/dev/null || true)"
+  if [[ -n "$github_remote_url" ]] && phase10_url_is_github_repo "$github_remote_url" "$GITHUB_USERNAME" "$repo_name"; then
+    log_success "github points to GitHub (${github_url})"
+    PASS=$((PASS + 1))
+  else
+    log_error "FAIL: github does not point to ${github_url} (found: ${github_remote_url:-<missing>})"
+    FAIL=$((FAIL + 1))
+  fi
+
+  branch_count=0
+  while IFS= read -r branch; do
+    [[ -z "$branch" ]] && continue
+    branch_count=$((branch_count + 1))
+    upstream_remote=$(git -C "$repo_path" for-each-ref --format='%(upstream:remotename)' "refs/heads/${branch}")
+    upstream_short=$(git -C "$repo_path" for-each-ref --format='%(upstream:short)' "refs/heads/${branch}")
+    if [[ "$upstream_remote" == "origin" ]] && [[ "$upstream_short" == "origin/${branch}" ]]; then
+      log_success "branch ${branch} tracks origin/${branch}"
+      PASS=$((PASS + 1))
+    else
+      log_error "FAIL: branch ${branch} tracks ${upstream_short:-<none>} (expected origin/${branch})"
+      FAIL=$((FAIL + 1))
+    fi
+  done < <(git -C "$repo_path" for-each-ref --format='%(refname:short)' refs/heads)
+
+  if [[ "$branch_count" -eq 0 ]]; then
+    log_warn "No local branches found in ${repo_name}"
+  fi
+done
+
+printf '\n'
+log_info "Results: ${PASS} passed, ${FAIL} failed"
+
+if [[ "$FAIL" -gt 0 ]]; then
+  log_error "Phase 10 post-check FAILED"
+  exit 1
+fi
+
+log_success "Phase 10 post-check PASSED — local repos track Gitea origin"