Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

charts/aptly/templates/ingress.yaml

@@ -0,0 +1,77 @@
+{{- include "aptly.exposureGuard" . -}}
+{{- if .Values.ingress.enabled }}
+{{- $fullname := include "aptly.fullname" . -}}
+{{- $svcName := $fullname -}}
+---
+# Repo Ingress — apt clients. In `single` mode this is also where /api/
+# traffic arrives; nginx does the read/write split internally (see
+# templates/_helpers.tpl's aptly.nginxConf). In `split` mode, note that this
+# is a DNS/Ingress-level split only: nginx does not itself reject /api/
+# requests that arrive via this host, so combine `split` mode with
+# security.write.inClusterOnly or a NetworkPolicy if you need that enforced.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullname }}
+  labels:
+    {{- include "aptly.labels" . | nindent 4 }}
+  annotations:
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.repo.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - {{- with .Values.ingress.repo.host }}
+      host: {{ . | quote }}
+      {{- end }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.repo.path }}
+            pathType: {{ .Values.ingress.repo.pathType }}
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  name: http
+{{- if and (eq .Values.ingress.mode "split") .Values.ingress.api.enabled (not .Values.security.write.inClusterOnly) }}
+---
+# API Ingress (split mode) — a separate host so you can put a different
+# ingressClass, mTLS, or WAF policy in front of the mutating API than the
+# public read path gets.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullname }}-api
+  labels:
+    {{- include "aptly.labels" . | nindent 4 }}
+  annotations:
+    {{- toYaml (merge .Values.ingress.api.annotations .Values.ingress.annotations) | nindent 4 }}
+spec:
+  {{- $apiClass := .Values.ingress.api.className | default .Values.ingress.className }}
+  {{- with $apiClass }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.api.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - {{- with .Values.ingress.api.host }}
+      host: {{ . | quote }}
+      {{- end }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ $svcName }}
+                port:
+                  name: http
+{{- end }}
+{{- end }}