ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/decisions/0003-composite-actions.md

@@ -77,17 +77,17 @@ fresh `make setup-image` runs.
 
 - **`ci.yml` validate job**: `setup-env` + `quality-checks` +
   `notify-failure`.
-- **`ci.yml` auto-merge job**: `setup-env` only (no quality checks,
-  no notify-failure — auto-merge failure is surfaced by the validate
-  job's notify-failure).
+- **`ci.yml` auto-merge job**: `setup-env` + `notify-failure` (no
+  quality checks — auto-merge only runs after validate passes).
 - **`post-merge.yml` detect-and-configure**: `setup-env` +
   `notify-failure`.
 - **`post-merge.yml` release-and-maintain**: `setup-env` (with
   `extras: "release"`) + `notify-failure`.
 - **`build-images.yml` build-and-push**: `notify-failure` only. The
-  setup steps use `make setup-release` and `make setup-ci` (not
-  `make setup-image`), so `setup-env` does not apply. The cleanup job
-  has no notify-failure step (it only runs on build-and-push success).
+  setup steps use `make setup-release` (not `make setup-image`), so
+  `setup-env` does not apply.
+- **`build-images.yml` cleanup**: `notify-failure` only. The setup
+  step uses `make setup-ci` (not `make setup-image`).
 
 ### Same-Repo Copies (No Cross-Repo References)
 

docs/tech/ci-cd-workflow.md

@@ -591,3 +591,8 @@ which runs `if: failure()`. This creates a Gitea issue with the workflow
 name, run ID, and commit SHA, ensuring failures that would otherwise go
 unnoticed in the Actions tab are surfaced as issues. The issue is created
 via the tea CLI with a `bug` label if available.
+
+Jobs with `notify-failure`:
+- `ci/validate`, `ci/auto-merge`
+- `post-merge/detect-and-configure`, `post-merge/release-and-maintain`
+- `build-images/build-and-push`, `build-images/cleanup`