Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

charts/aptly/ci/full-featured.yaml

@@ -0,0 +1,82 @@
+# Exercises: existingClaim, existingSecret (auth + gpg), metrics + ServiceMonitor,
+# networkPolicy, PDB, declarative state (gpgKeys/localRepos/mirrors/publish),
+# configOverrides passthrough, extra* escape hatches.
+persistence:
+  existingClaim: my-existing-pvc
+
+security:
+  preset: authenticated
+  auth:
+    existingSecret: my-htpasswd-secret
+  trustedProxies: ["10.0.0.0/8"]
+  write:
+    allowCIDRs: ["10.42.0.0/16"]
+
+aptly:
+  architectures: [amd64, arm64]
+  metrics:
+    enabled: true
+  gpg:
+    signingKey:
+      existingSecret: my-signing-key-secret
+  gpgKeys:
+    - name: debian-archive
+      armored: |
+        -----BEGIN PGP PUBLIC KEY BLOCK-----
+        dGVzdA==
+        -----END PGP PUBLIC KEY BLOCK-----
+  localRepos:
+    - name: stable
+      comment: "Production repo"
+      defaultDistribution: stable
+      defaultComponent: main
+  mirrors:
+    - name: debian-security
+      archiveURL: http://security.debian.org/debian-security
+      distribution: trixie-security
+      components: [main]
+      architectures: [amd64, arm64]
+  publish:
+    - name: stable-root
+      prefix: ""
+      distribution: stable
+      sourceKind: local
+      sources: [{ name: stable, component: main }]
+      architectures: [amd64, arm64]
+      acquireByHash: true
+  configOverrides:
+    download_concurrency: 8
+  existingSecretEnv: ["some-other-secret"]
+
+metrics:
+  service:
+    enabled: true
+  serviceMonitor:
+    enabled: true
+
+networkPolicy:
+  enabled: true
+  allowedNamespaces: ["ci", "monitoring"]
+
+podDisruptionBudget:
+  enabled: true
+  maxUnavailable: 1
+
+reconcile:
+  mode: job
+
+extraEnv:
+  - name: FOO
+    value: bar
+extraVolumes:
+  - name: extra
+    emptyDir: {}
+extraVolumeMounts:
+  - name: extra
+    mountPath: /extra
+nodeSelector:
+  kubernetes.io/os: linux
+tolerations:
+  - key: "example"
+    operator: "Exists"
+priorityClassName: "high-priority"