Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

charts/aptly/templates/secret-credentials.yaml

@@ -0,0 +1,34 @@
+{{- $fullname := include "aptly.fullname" . -}}
+{{- $secretName := printf "%s-credentials" $fullname -}}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
+{{- $internalPassword := "" -}}
+{{- if and $existing (hasKey $existing.data "internal-password") -}}
+{{- $internalPassword = index $existing.data "internal-password" | b64dec -}}
+{{- else -}}
+{{- $internalPassword = randAlphaNum 32 -}}
+{{- end -}}
+{{- $userLines := list -}}
+{{- range $name, $pass := .Values.security.auth.users -}}
+{{- $userLines = append $userLines (printf "%s:%s" $name $pass) -}}
+{{- end -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $secretName }}
+  labels:
+    {{- include "aptly.labels" . | nindent 4 }}
+  annotations:
+    # Reused across `helm upgrade` (via `lookup` above) and preserved across
+    # `helm uninstall` so aptly-reconcile keeps working without a manual step
+    # after a reinstall. Never regenerate this key from a template — see
+    # rootfs/usr/local/bin/aptly-init for why hashing must not happen here.
+    helm.sh/resource-policy: keep
+type: Opaque
+stringData:
+  internal-password: {{ $internalPassword | quote }}
+  {{- if $userLines }}
+  users: |
+    {{- range $userLines }}
+    {{ . }}
+    {{- end }}
+  {{- end }}