ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/decisions/0003-composite-actions.md

@@ -77,17 +77,17 @@ fresh `make setup-image` runs.
 
 - **`ci.yml` validate job**: `setup-env` + `quality-checks` +
   `notify-failure`.
-- **`ci.yml` auto-merge job**: `setup-env` only (no quality checks,
-  no notify-failure — auto-merge failure is surfaced by the validate
-  job's notify-failure).
+- **`ci.yml` auto-merge job**: `setup-env` + `notify-failure` (no
+  quality checks — auto-merge only runs after validate passes).
 - **`post-merge.yml` detect-and-configure**: `setup-env` +
   `notify-failure`.
 - **`post-merge.yml` release-and-maintain**: `setup-env` (with
   `extras: "release"`) + `notify-failure`.
 - **`build-images.yml` build-and-push**: `notify-failure` only. The
-  setup steps use `make setup-release` and `make setup-ci` (not
-  `make setup-image`), so `setup-env` does not apply. The cleanup job
-  has no notify-failure step (it only runs on build-and-push success).
+  setup steps use `make setup-release` (not `make setup-image`), so
+  `setup-env` does not apply.
+- **`build-images.yml` cleanup**: `notify-failure` only. The setup
+  step uses `make setup-ci` (not `make setup-image`).
 
 ### Same-Repo Copies (No Cross-Repo References)