Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

compose/docker-compose.test.yaml

@@ -0,0 +1,75 @@
+# Test stack: fully open (no auth on read OR write), unsigned, ephemeral
+# volumes, ready to use with a single `docker compose -f compose/docker-compose.test.yaml up`.
+# This is also what tests/smoke-test.sh drives — see docs/quickstart-compose.md.
+#
+# Topology mirrors production (aptly-init -> aptly -> nginx, aptly never
+# reachable from outside the compose network) so that what you test here is
+# what you'd actually run, just with the security matrix dialed to "open".
+services:
+  aptly-init:
+    build:
+      context: ..
+      dockerfile: images/aptly-server/Dockerfile
+    entrypoint: ["/usr/local/bin/aptly-init"]
+    environment:
+      APTLY_GPG_ENABLED: "false"
+    volumes:
+      - ./config/aptly.yaml:/etc/aptly-src/aptly.yaml:ro
+      - aptly_run:/run/aptly
+    restart: "no"
+
+  aptly:
+    build:
+      context: ..
+      dockerfile: images/aptly-server/Dockerfile
+    depends_on:
+      aptly-init:
+        condition: service_completed_successfully
+    environment:
+      APTLY_API_LISTEN: "0.0.0.0:8080"
+    volumes:
+      - aptly_data:/var/lib/aptly
+      - aptly_run:/run/aptly
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8080/api/healthy"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+      start_period: 5s
+
+  nginx:
+    image: nginxinc/nginx-unprivileged:1-alpine
+    depends_on:
+      aptly:
+        condition: service_healthy
+    volumes:
+      - aptly_data:/var/lib/aptly:ro
+      - aptly_run:/run/aptly:ro
+      - ./config/nginx.test.conf:/etc/nginx/conf.d/default.conf:ro
+    ports:
+      - "8080:8080"
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/healthz"]
+      interval: 5s
+      timeout: 3s
+      retries: 20
+
+  reconcile:
+    build:
+      context: ..
+      dockerfile: images/aptly-server/Dockerfile
+    depends_on:
+      aptly:
+        condition: service_healthy
+    entrypoint: ["/usr/local/bin/aptly-reconcile"]
+    environment:
+      APTLY_URL: "http://aptly:8080"
+      APTLY_STATE_FILE: "/state.yaml"
+      APTLY_FAIL_ON_ERROR: "true"
+    volumes:
+      - ./config/state.test.yaml:/state.yaml:ro
+    restart: "no"
+
+volumes:
+  aptly_data:
+  aptly_run: