ci: run tests, real Lean + Mathlib smoke and image build on the lean4.35 runner

Moves the Lean project to Lean 4.35.0 / Mathlib v4.35.0 to match the runner,
caches the Mathlib project on the runner host, and builds and keeps the Docker
image only after the Python and Lean jobs pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FYqwNMyPUHeTbFWg83GQq6

.gitea/scripts/prepare-mathlib.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Keep a ready Lean + Mathlib project on the runner host, keyed by the project's
+# toolchain and lakefile, so only the first job pays for the multi-GB cache fetch.
+#
+#   prepare-mathlib.sh <lean-project-dir>     prints the cached project path
+#
+# The runner executes jobs on the host (no container), so /opt/lean-cache persists
+# between jobs. A flock serialises concurrent jobs; .ready is written last, so an
+# interrupted preparation is redone rather than trusted.
+set -euo pipefail
+
+SRC="${1:?usage: prepare-mathlib.sh <lean-project-dir>}"
+ROOT="${LEAN_CACHE_ROOT:-/opt/lean-cache}"
+KEY="$(cat "$SRC/lean-toolchain" "$SRC/lakefile.toml" | sha256sum | cut -c1-12)"
+DIR="$ROOT/leanbench-$KEY"
+
+mkdir -p "$ROOT"
+exec 9>"$ROOT/.lock"
+flock 9
+
+if [ -f "$DIR/.ready" ]; then
+  echo "prepare-mathlib: reusing $DIR" >&2
+else
+  echo "prepare-mathlib: building $DIR (first run on this toolchain/lakefile)" >&2
+  rm -rf "$DIR"
+  cp -r "$SRC" "$DIR"
+  cd "$DIR"
+  elan toolchain install "$(cat lean-toolchain)" >&2
+  timeout 1800 lake update >&2
+  timeout 5400 lake exe cache get >&2
+  start=$(date +%s)
+  timeout 1200 lake env lean LeanBench.lean >&2 || {
+    status=$?
+    [ "$status" -eq 124 ] && echo "prepare-mathlib: 'import Mathlib' timed out; check RAM (free -h)" >&2
+    exit "$status"
+  }
+  echo "prepare-mathlib: import Mathlib elaborated in $(( $(date +%s) - start ))s" >&2
+  touch .ready
+fi
+echo "$DIR"