Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

.gitea/workflows/ci.yaml

@@ -0,0 +1,77 @@
+name: CI
+# Runs on every PR and every push to main. The smoke-test job is the actual
+# merge gate for this repo — it proves pack -> push -> publish -> apt-get
+# works, not just that files parse. See tests/smoke-test.sh.
+#
+# paths-ignore + bot commits carrying [skip ci] (see release-image.yaml)
+# exist to break the automation loop: an image release commits a new
+# appVersion to main, which would otherwise re-trigger this workflow, which
+# has nothing new to check.
+on:
+  pull_request: {}
+  push:
+    branches: [main]
+    paths-ignore:
+      - 'charts/aptly/Chart.yaml'
+      - 'CHANGELOG.md'
+
+concurrency:
+  group: ci-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: hadolint (aptly-server)
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: images/aptly-server/Dockerfile
+      - name: hadolint (aptly-deb-builder)
+        uses: hadolint/hadolint-action@v3.1.0
+        with:
+          dockerfile: images/aptly-deb-builder/Dockerfile
+
+      - name: shellcheck
+        run: |
+          docker run --rm -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x \
+            rootfs/usr/local/bin/aptly-* rootfs/usr/local/bin/lib/common.sh tests/smoke-test.sh
+
+      - uses: azure/setup-helm@v4.3.0
+        with:
+          version: ${{ vars.HELM_VERSION || '3.16.4' }}
+      - name: helm lint
+        run: helm lint charts/aptly
+      - name: helm template (every ci/*.yaml values file, plus defaults)
+        run: |
+          set -e
+          helm template test charts/aptly > /tmp/rendered-defaults.yaml
+          for f in charts/aptly/ci/*.yaml; do
+            helm template test charts/aptly -f "$f" > "/tmp/rendered-$(basename "$f" .yaml).yaml"
+          done
+      - name: kubeconform
+        run: |
+          docker run --rm -v /tmp:/tmp ghcr.io/yannh/kubeconform:latest \
+            -summary -strict -kubernetes-version 1.29.0 \
+            -schema-location default \
+            -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' \
+            /tmp/rendered-*.yaml
+      - name: fail-guard regression check (proxy.enabled=false + Ingress/Gateway + non-open preset must abort)
+        run: |
+          if helm template test charts/aptly --set proxy.enabled=false --set ingress.enabled=true \
+               --set ingress.repo.host=x.example.com >/tmp/should-fail.yaml 2>&1; then
+            echo "::error::expected `helm template` to fail on proxy.enabled=false + ingress.enabled (fail-guard regression)"; exit 1
+          fi
+          if helm template test charts/aptly --set proxy.enabled=false --set gateway.enabled=true \
+               --set 'gateway.parentRefs[0].name=x' >/tmp/should-fail2.yaml 2>&1; then
+            echo "::error::expected `helm template` to fail on proxy.enabled=false + gateway.enabled (fail-guard regression)"; exit 1
+          fi
+
+  smoke-test:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Run the end-to-end smoke test
+        run: ./tests/smoke-test.sh