ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/build-images.yml

@@ -51,13 +51,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-release
       - name: Check if this is a release commit
         id: check
-        env:
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.ci.detect_release_commit
@@ -65,9 +61,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: |
           . .venv/bin/activate
           _TOKEN="$CI_GITEA_API_TOKEN"
@@ -79,10 +72,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
@@ -126,13 +115,8 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-ci
       - name: Clean up old image versions
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.tools.clean_images \
@@ -141,3 +125,6 @@ jobs:
             --name oblachno-oss/runner-images/ci-quality \
             --name oblachno-oss/runner-images/ci-full \
             --keep 2
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "build-images/cleanup"