Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

.gitea/workflows/rebuild.yaml

@@ -0,0 +1,71 @@
+name: Weekly rebuild
+# Bumps the image revision (1.6.3-1 -> 1.6.3-2) and tags it, which triggers
+# release-image.yaml — the mechanism that pulls in Debian base-image security
+# patches even between aptly releases. This is the "aptly keeps itself
+# current" half that isn't a Renovate PR: it needs zero human action to land.
+#
+# Gitea's `schedule` trigger only fires from the default branch — a branch
+# rename silently disables this. Because Gitea Actions only implements
+# always() among the status-check expressions (not success()/failure()),
+# failure handling below uses `continue-on-error` + a status file instead of
+# `if: failure()`.
+on:
+  schedule:
+    - cron: '17 3 * * 1'
+  workflow_dispatch: {}
+
+jobs:
+  bump-revision:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Find the latest image tag and compute the next revision
+        id: next
+        continue-on-error: true
+        run: |
+          set -euo pipefail
+          latest="$(git tag --list 'image/v*' --sort=-v:refname | head -1)"
+          if [[ -z "$latest" ]]; then
+            echo "::error::no existing image/v* tag found — cut one manually first (see docs/versioning.md)"
+            exit 1
+          fi
+          version_rev="${latest#image/v}"
+          version="${version_rev%-*}"
+          revision="${version_rev##*-}"
+          next_revision=$(( revision + 1 ))
+          echo "next_tag=image/v${version}-${next_revision}" >> "$GITEA_OUTPUT"
+          echo "latest_tag=${latest}" >> "$GITEA_OUTPUT"
+
+      - name: Stale-rebuild check (fires regardless of the step above)
+        if: always()
+        run: |
+          latest_epoch="$(git log -1 --format=%at "$(git tag --list 'image/v*' --sort=-v:refname | head -1)" 2>/dev/null || echo 0)"
+          now_epoch="$(date +%s)"
+          days=$(( (now_epoch - latest_epoch) / 86400 ))
+          threshold="${STALE_REBUILD_DAYS:-14}"
+          echo "days since last image tag: ${days} (threshold: ${threshold})"
+          if [[ "$days" -gt "$threshold" ]]; then
+            echo "::warning::no new image tag in ${days} days — check whether this workflow (or Renovate) is still running"
+          fi
+
+      - name: Tag and push
+        if: steps.next.outcome == 'success'
+        run: |
+          git config user.name "${{ gitea.actor }}"
+          git config user.email "${{ gitea.actor }}@noreply.git.morlana.online"
+          git tag "${{ steps.next.outputs.next_tag }}"
+          git push origin "${{ steps.next.outputs.next_tag }}"
+          echo "tagged ${{ steps.next.outputs.next_tag }} (rebuild of ${{ steps.next.outputs.latest_tag }}'s aptly version)"
+
+      - name: Report failure (opens an issue; the next successful run closes it)
+        if: always() && steps.next.outcome != 'success'
+        env:
+          GITEA_API: https://git.morlana.online/api/v1
+          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          curl -fsS -X POST "${GITEA_API}/repos/${{ gitea.repository }}/issues" \
+            -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" \
+            -d "{\"title\":\"rebuild.yaml failed on $(date -u +%F)\",\"body\":\"See the workflow run: ${{ gitea.server_url }}/${{ gitea.repository }}/actions\"}"