docs: document CI status check and main branch protection

Add a Gitea Actions test-status badge plus a short README "CI" section
covering how to read the check and what to do when it's red. Capture
the (out-of-tree) branch-protection rule on `main` in docs/ci.md so
the gate that requires the test check is reproducible from the repo
alone — covers both the Gitea UI path and the equivalent API call.

Refs: PRD 0002

Assisted-by: Claude Code

README.md

@@ -1,5 +1,7 @@
 # claude-bottle
 
+[![test](https://gitea.dideric.is/didericis/claude-bottle/actions/workflows/test.yml/badge.svg?branch=main)](https://gitea.dideric.is/didericis/claude-bottle/actions?workflow=test.yml)
+
 Spins up an isolated container for running Claude Code with a curated set of skills and env vars.
 
 ## Why "claude-bottle"?
@@ -37,6 +39,30 @@ The container is removed automatically when the session ends. If the script
 is killed with SIGKILL the exit trap won't fire and the container may be
 left running; remove it with `docker rm -f <container-name>`.
 
+## CI
+
+Every push to a PR (and every push to `main`) runs the full test suite
+on Gitea Actions via `.gitea/workflows/test.yml`. The status badge at
+the top of this README links to the workflow's run history; the same
+check appears on each PR.
+
+Reading the check:
+
+- Green — `tests/run_tests.py` exited 0 on the runner.
+- Red — at least one test failed (or the workflow itself errored).
+  Click through to the run, expand the failing step, and read the
+  unittest output. Reproduce locally with `tests/run_tests.py` (or
+  `tests/run_tests.py unit` if you don't have Docker handy);
+  integration tests skip cleanly when Docker isn't reachable.
+- Skipped tests — expected when the runner has no Docker daemon. They
+  still leave the job green; if you actually want them executed,
+  ensure Docker is available on the runner host.
+
+Pushing a fix to a red PR re-triggers the workflow automatically — no
+manual rerun needed. Branch protection on `main` requires this check
+to be green before the merge button is enabled; see [`docs/ci.md`](docs/ci.md)
+for how those rules are configured.
+
 ## Egress
 
 Agent containers route HTTP / HTTPS traffic through a per-agent