Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

compose/config/state.yaml

@@ -0,0 +1,31 @@
+# Declarative aptly state for docker-compose.yaml (production). Consumed by
+# aptly-reconcile on every start of the `reconcile` service — safe to edit and
+# restart that service as often as you like, it only converges towards
+# whatever is described here (see docs/packaging.md).
+#
+# Uncomment and adjust the example below to get your first repo + publish
+# target, or add your own. See rootfs/usr/local/bin/aptly-reconcile for the
+# full field reference.
+
+localRepos: []
+  # - name: stable
+  #   comment: "Production package repository"
+  #   defaultDistribution: stable
+  #   defaultComponent: main
+
+mirrors: []
+  # - name: debian-security
+  #   archiveURL: http://security.debian.org/debian-security
+  #   distribution: trixie-security
+  #   components: [main]
+  #   architectures: [amd64, arm64]
+
+publish: []
+  # - name: stable-root
+  #   prefix: ""
+  #   distribution: stable
+  #   sourceKind: local
+  #   sources:
+  #     - { name: stable, component: main }
+  #   architectures: [amd64, arm64]
+  #   acquireByHash: true