Forensic checks for CVE-2026-60004 exploitation in Gitea

Evidence to preserve and review when a Gitea instance may have been exploited through diffpatch.