Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

images/aptly-deb-builder/Dockerfile

@@ -0,0 +1,50 @@
+# syntax=docker/dockerfile:1
+#
+# aptly-deb-builder — turns a source tree into a signed-and-pushable .deb in
+# one command (aptly-release). Ships both packaging paths:
+#   - nfpm, for projects with no debian/ directory (a plain YAML descriptor)
+#   - the real Debian toolchain, for projects that already have a debian/ dir
+#
+# renovate: datasource=github-releases depName=goreleaser/nfpm
+ARG NFPM_VERSION=2.47.0
+ARG NFPM_SHA256_AMD64=3f1cf344bd0b57373ca55636a78c08b0491f7293d609a456a9ac3b0b150fda97
+ARG NFPM_SHA256_ARM64=27419eb382695a7942be8ad52259f3ec1854fad001b3ae4baed34ce39a223b97
+ARG RUNTIME_IMAGE=debian:trixie-slim
+
+FROM ${RUNTIME_IMAGE}
+ARG TARGETARCH
+ARG NFPM_VERSION
+ARG NFPM_SHA256_AMD64
+ARG NFPM_SHA256_ARM64
+
+LABEL org.opencontainers.image.title="aptly-deb-builder" \
+      org.opencontainers.image.description="Package, build and push .deb packages into an aptly repository in one step" \
+      org.opencontainers.image.source="https://git.morlana.online/f.weber/aptly-containerized" \
+      org.opencontainers.image.licenses="MIT"
+
+# hadolint ignore=DL3008
+RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
+    --mount=type=cache,target=/var/lib/apt,sharing=locked \
+    apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl jq gnupg \
+      build-essential debhelper devscripts dpkg-dev fakeroot equivs \
+    && rm -rf /var/lib/apt/lists/*
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN set -eux; \
+    case "${TARGETARCH}" in \
+      amd64) sha256="${NFPM_SHA256_AMD64}" ;; \
+      arm64) sha256="${NFPM_SHA256_ARM64}" ;; \
+      *) echo "unsupported TARGETARCH: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL -o /tmp/nfpm.deb "https://github.com/goreleaser/nfpm/releases/download/v${NFPM_VERSION}/nfpm_${NFPM_VERSION}_${TARGETARCH}.deb"; \
+    echo "${sha256}  /tmp/nfpm.deb" | sha256sum -c -; \
+    dpkg -i /tmp/nfpm.deb; \
+    rm -f /tmp/nfpm.deb
+
+COPY rootfs/usr/local/bin/aptly-pack rootfs/usr/local/bin/aptly-push rootfs/usr/local/bin/aptly-release /usr/local/bin/
+COPY rootfs/usr/local/bin/lib/ /usr/local/bin/lib/
+
+WORKDIR /work
+ENTRYPOINT []
+CMD ["bash"]