Add gdlint job + gdlintrc to Gitea CI

Lints scripts/, db/, scenes/ via gdtoolkit==4.* on ubuntu-latest
(Python, no Godot needed), in parallel with the validate job.
addons/ (third-party LOD plugin) and developers/ (sandbox) are
left out. Non-blocking for now: the export jobs still only need
validate, so a lint regression won't break builds while the
Godot-3 leftover code is being cleaned up.

gdlintrc bumps max-line-length from 100 to 140 because Godot
$-style node paths and typed signatures routinely push past 100
without that being a real readability problem.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/README.md

@@ -8,6 +8,7 @@ Workflow defined in [`build.yml`](./build.yml). Triggered on push / PR to
 | Job                  | Image                       | Role                                                                                     |
 |----------------------|-----------------------------|------------------------------------------------------------------------------------------|
 | `validate`           | `barichello/godot-ci:4.6`   | `godot --headless --import` then grep for `SCRIPT ERROR` / `Parse Error`. Uploads `.godot/` cache. |
+| `lint`               | `ubuntu-latest` (Python)    | `gdlint scripts db scenes` via `gdtoolkit==4.*` (Scony). Parallel to `validate`; does not gate exports yet. |
 | `export-desktop`     | `barichello/godot-ci:4.6`   | Matrix: Windows / Linux / macOS. Reuses the import cache, uploads each binary as artifact. |
 | `export-android`     | `barichello/godot-ci:4.6` + JDK 17 + Android SDK installed at runtime | Provisions keystore, writes `editor_settings-4.tres` with SDK / JDK paths, exports APK. |
 
@@ -31,6 +32,21 @@ Artifacts are kept 14 days, accessible from the Gitea run page.
    stored as a Gitea repo secret. Without it, a throwaway keystore is
    generated per run, so the APK signature changes every build.
 
+## Linting
+
+`gdlint` (from Scony's `gdtoolkit`) runs in the `lint` job over `scripts/`,
+`db/`, and `scenes/`. `addons/` (third-party LOD plugin) and `developers/`
+(sandbox) are intentionally excluded.
+
+The job is **non-blocking** today — the export jobs only depend on
+`validate`, so a lint failure prints warnings but still produces binaries.
+Once the codebase is clean, switch the export jobs' `needs: validate` to
+`needs: [validate, lint]` to make lint a hard gate.
+
+Suppress specific rules per-line with `# gdlint: disable=<rule>` or
+project-wide with a `gdlintrc` file at the repo root (see
+[gdtoolkit docs](https://github.com/Scony/godot-gdscript-toolkit/wiki)).
+
 ## Differences from the old `.drone.yml`
 
 - No more Drone, no more Butler — build only, artifacts downloadable from