Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

charts/aptly/templates/NOTES.txt

@@ -0,0 +1,89 @@
+{{- $fullname := include "aptly.fullname" . -}}
+{{- $sec := include "aptly.security" . | fromJson -}}
+aptly ({{ .Chart.AppVersion }}, chart {{ .Chart.Version }}) is deploying as {{ $fullname }}-0 in {{ .Release.Namespace }}.
+
+{{- if eq .Values.security.preset "open" }}
+
+  *** security.preset: open ***
+  Both reading AND writing (the mutating /api/ path) are reachable with NO
+  authentication from anything that can reach the Service — this is exactly
+  the "komplett unabgesichert" mode, working as configured. Nothing further
+  to set up; just make sure this is really what you want before exposing it
+  beyond your own network.
+{{- end }}
+
+--- Check it's up -------------------------------------------------------
+
+  kubectl exec -n {{ .Release.Namespace }} {{ $fullname }}-0 -c aptly -- \
+    curl -fsS http://127.0.0.1:8080/api/ready
+
+  kubectl logs -n {{ .Release.Namespace }} job/{{ $fullname }}-reconcile
+    # (only present right after install/upgrade in `hook` mode)
+
+--- Reach it -------------------------------------------------------------
+
+{{- if .Values.ingress.enabled }}
+{{- with .Values.ingress.repo.host }}
+
+  https://{{ . }}/   (Ingress)
+{{- end }}
+{{- end }}
+{{- if .Values.gateway.enabled }}
+{{- range .Values.gateway.repo.hostnames }}
+
+  https://{{ . }}/   (Gateway API)
+{{- end }}
+{{- end }}
+{{- if not (or .Values.ingress.enabled .Values.gateway.enabled) }}
+
+  kubectl port-forward -n {{ .Release.Namespace }} svc/{{ $fullname }} 8080:{{ .Values.service.port }}
+  # then use http://127.0.0.1:8080/ below
+{{- end }}
+
+--- Configure apt on a client ---------------------------------------------
+
+{{- $host := "apt.example.com" }}
+{{- if and .Values.ingress.enabled .Values.ingress.repo.host }}
+{{- $host = .Values.ingress.repo.host }}
+{{- else if and .Values.gateway.enabled .Values.gateway.repo.hostnames }}
+{{- $host = first .Values.gateway.repo.hostnames }}
+{{- end }}
+{{- if .Values.aptly.gpg.enabled }}
+{{- if .Values.aptly.gpg.publishPublicKey.enabled }}
+
+  curl -fsSL https://{{ $host }}{{ .Values.aptly.gpg.publishPublicKey.path }} \
+    | gpg --dearmor | sudo tee /usr/share/keyrings/{{ include "aptly.name" . }}.gpg >/dev/null
+
+  echo 'deb [signed-by=/usr/share/keyrings/{{ include "aptly.name" . }}.gpg] https://{{ $host }}/ <dist> <component>' \
+    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
+{{- else }}
+
+  aptly.gpg.enabled=true but aptly.gpg.publishPublicKey.enabled=false — the
+  signing key is not being served; distribute it to clients yourself.
+  echo 'deb [signed-by=/path/to/your-key.gpg] https://{{ $host }}/ <dist> <component>' \
+    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
+{{- end }}
+{{- else }}
+
+  echo 'deb [trusted=yes] https://{{ $host }}/ <dist> <component>' \
+    | sudo tee /etc/apt/sources.list.d/{{ include "aptly.name" . }}.list
+{{- end }}
+{{- if $sec.ra }}
+
+  Reads require credentials in this preset ({{ .Values.security.preset }}):
+    echo 'machine {{ $host }} login <user> password <password>' \
+      | sudo tee -a /etc/apt/auth.conf.d/{{ include "aptly.name" . }}.conf
+{{- end }}
+
+--- Resizing storage later -------------------------------------------------
+
+  persistence.size on an already-installed StatefulSet is IMMUTABLE via
+  `helm upgrade` (Kubernetes forbids changing volumeClaimTemplates in place).
+  For production, set persistence.existingClaim to a PVC you manage yourself
+  — resizing that is a plain PVC edit. See docs/operations.md for the
+  recovery procedure if you need to resize a chart-managed PVC anyway.
+{{- if and .Values.podDisruptionBudget.enabled (le (int .Values.podDisruptionBudget.maxUnavailable) 0) }}
+
+  *** podDisruptionBudget.maxUnavailable is 0 with replicas=1 — this blocks
+  every voluntary node drain forever. ***
+{{- end }}