CI: fail when the upstream name appears in a new string literal

tools/fork/name-check.py reads every string literal in crates/ (comments
and test directories skipped) and fails on any that carries the upstream
name without an entry in name-allowlist.txt. An upstream merge can bring
such strings in without a conflict, so it runs on every push and PR.

The first run found three the earlier sweeps missed, fixed here: the SMTP
HELP reply pointed at upstream's website (now brand_url!), the event
collector thread was named after upstream, and the FreeBSD default data
path still said /var/db/stalwart/ where Linux already had /var/lib/inbuxa/.

Two operator-visible defaults are allowlisted as open, pending a decision:
the log file prefix and the SQL stores' default database and user.

.gitea/workflows/ci.yml

@@ -20,6 +20,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # The upstream name in a new string literal, typically brought in by an
+  # upstream merge. Seconds, and needs no toolchain. tools/fork/name-check.py.
+  name-check:
+    runs-on: light
+    container:
+      image: python:3.13-slim@sha256:8d9d0b8bcf6506481eae4907c18f5e3e7902e629f5f6d684f9e7c32e85e3ddf0 # 3.13-slim
+    steps:
+      - uses: coffey-labs/actions/checkout@fab0c4d45e0162963965f1555df27b7bed5e20ec
+      - run: python3 tools/fork/name-check.py
+
   build:
     # Either runner (host1 or host2): the build needs no docker socket.
     runs-on: light