ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/ci.yml

@@ -121,7 +121,6 @@ jobs:
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
           REPOSITORY: ${{ github.repository }}
         run: |
@@ -135,7 +134,6 @@ jobs:
             --body "Auto-approved: all CI checks passed (validate job)."
       - name: Squash merge with task ID
         env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           DEVX_VIKUNJA_PROJECT_ID: "8"
           HEAD_REF: ${{ github.head_ref }}
@@ -149,3 +147,6 @@ jobs:
             "$PR_TITLE" \
             "$REPOSITORY" \
             "$PR_NUMBER"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "ci/auto-merge"