Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

pubkeys/README.md

@@ -0,0 +1,62 @@
+# Public keys
+
+## Chart signing key (needed, not yet set up)
+
+`.gitea/workflows/release-chart.yaml` runs `helm package --sign` to produce a
+`.tgz.prov` file for every chart release, and `charts/aptly/Chart.yaml` is meant to
+carry an `artifacthub.io/signKey` annotation pointing at the public half of that
+key (both are currently commented out / referencing a placeholder — see below).
+
+**This key must NOT be Ed25519/EdDSA.** Helm's chart signing is built on the
+deprecated `golang.org/x/crypto/openpgp` library, which cannot read Ed25519 keys at
+all — signing fails with `Error: private key not found` (or, depending on gpg
+version, `openpgp: unsupported feature: public key type: 22`). This is a
+long-standing, unresolved upstream limitation (helm/helm#11634, #31180, #31181), not
+a configuration mistake — confirmed by reproducing it locally against a throwaway
+Ed25519 test key before writing this note. Use **RSA** (4096-bit, no expiry is
+fine for a CI signing key) or a classic ECC curve helm's openpgp fork supports;
+RSA is the safest choice since it's unambiguously supported.
+
+The org's existing "Morlana CI Signing Key" (used by e.g. `bookstack-chart`) is
+Ed25519 and was tried here first — it does not work for this purpose. It may still
+be perfectly valid for other things (signing an actual apt repository via
+`aptly.gpg.signingKey`, which is a completely different code path that does support
+Ed25519 — see [docs/packaging.md](../docs/packaging.md#gpg) — just not for
+`helm package --sign`. This repo therefore needs its own, separate, RSA key
+dedicated to chart-package signing.
+
+### Generating it
+
+Run this yourself (locally, not in CI) so the private key material never has to
+pass through anything but your own machine and the Gitea secrets store:
+
+```bash
+gpg --full-generate-key
+# RSA and RSA (default)
+# 4096 bit
+# key does not expire (or a long expiry — a CI signing key you'd have to rotate
+# on a schedule is more operational overhead than it's worth here)
+# Name: Aptly Chart Signing Key
+# Email: something you control, e.g. contact+development@morlana.net
+
+gpg --list-secret-keys --with-colons | awk -F: '$1=="sec"{print $5}'   # -> the key ID
+gpg --armor --export <key-id> > pubkeys/chart-signing.asc
+gpg --armor --export-secret-keys <key-id>                              # -> paste as GPG_PRIVATE_KEY
+```
+
+Then, in the repo's Gitea settings:
+- Secret **`GPG_PRIVATE_KEY`** — the armored output of the last command above
+- Secret **`GPG_PASSPHRASE`** — whatever passphrase you set (empty string if none)
+- Secret **`GPG_KEY_ID`** — the key ID or fingerprint from `gpg --list-secret-keys`
+
+Commit `pubkeys/chart-signing.asc`, then uncomment the `artifacthub.io/signKey`
+block in `charts/aptly/Chart.yaml` with the real fingerprint, and uncomment
+`pubkeys/chart-signing.asc` in `release-chart.yaml`'s release-assets step.
+
+### Verifying a downloaded chart (once the key exists)
+
+```bash
+gpg --import pubkeys/chart-signing.asc
+gpg --export > /tmp/pubring.gpg   # legacy binary format — helm can't read pubring.kbx
+helm verify aptly-<version>.tgz --keyring /tmp/pubring.gpg
+```

pubkeys/chart-signing.asc

@@ -0,0 +1,53 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGp8Ox8BEACpuaxGZoPiwCBeSBigfVFrT6Bo9v/XhJxaJGDD4HLmA0Dy8aPI
+KVcINstQdrGFcoP7MS+oSLkFUbslZkTdKOwv6OX2R5PeW05HfzuCkEPawVNrfzzz
+fWp1c8eOvw2siUO3xKg5IhkivoDmZcLlvRkmu2h4kb8+YN2QycOx1I/VsG6I+FGC
+Kmz6pMqYbPmKpRYQ4X6IaovvcVGTMMRL4ARat82rS/QL0ZwW2qyj7NsXKgZEc8AN
+wngSiR7SKB2CXKPnC3EB/G1c2i93bkwmz96u+TulQaumQ/dwEscT0L7xP5zsjE7u
+dxYessuSsYX1WmOygISxQDh2DZcPw/YfSoPusEq9AVO2rlC1ivYL9Wc5U8UV5A6g
+9EjR/M9bWvr8CO9jw9xsmYE4sgbc4E4HPpeFkg+r7cmbHIxBWlwsAcTFaA1ls5I0
+hzxPx0KX89w8BjHcvq91O3HOVk5wpZf1kOg59lsBqwa/ytFoX49tlwK9rJ6vm+Nt
+WMfKQZqUn1hO2KQqlBhQO+CMD8qbkMkCLoii+JMsIf+9Kr+lS650AcWt6jGy8so5
+KWgvgqH1aX/964I1kujNsJxky2+XF9h7MofvLxpoXIfjKFNkW2q0Fex8xy05fChE
+Kevsw5/++zhqE8zGoXpknAa7mud46kkgDMmDnYK8CyFfJpoQ48c/MbwmDwARAQAB
+tG1Nb3JsYW5hIEhlbG0gQ2hhcnRzIChUaGlzIGtleSBpcyBvbmx5IGJlIHVzZWQg
+dG8gc2lnbiBNb3JsYW5hcyBIZWxtIENoYXJ0cy4pIDxjb250YWN0K2hlbG1jaGFy
+dHNAbW9ybGFuYS5uZXQ+iQJRBBMBCgA7FiEE/DXA+qJmBcTCHHu/v0OIQUXlqpQF
+Amp8Ox8CGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQv0OIQUXlqpQ/
+fBAAlJF9RxUVN/Tj+byuy24k/JyVcSbJH5QhF6sqAR8mDNnCr02S4CIICgAhagBl
+VUXkH50k92iEh8QC3yXY1RakibBd5XtOF1Pw07/Hg73/wYa4+WgZqODxt2OUhCg1
+VVTLh1dNSniD37bCOFfqYtUv/UNEhqzMQSHecvDY9DfVFWVxvP9vxSCCYsQesCQD
+DqzdYU3xW3EeT0KB8JuMoSgxai6pL1d0irKw8NJ06u9uLoSmcc5M9vPAlnLlO3WO
+9ZoGKkwfbStN/VfAi7YF+stO1c+2RGeR4XilNRgbcflaInKwOdYne2yJaUf5pccw
+INbJuDyaJJ0/Q+xs+pjCnZeDhrGCjWxSD6FZYsDOHnut031v/XDNz3jjlrOwYZXh
+rVAz5aqkydDmO/MG+u474YH+L7uK2ZnR+/ktEaKaSaGOrLAh8oR058q2Aisbq5V+
+1cenBwpQGnlMaFUArubDbgDNlfdf3l0ZYatmVy3H+Hvz2geTQ3J0tmbzHMSfOqvh
+5le1LzUpGSMItNxcRP4Ba8PUtgiuwCpthKal7sXLWHj/CzXQcoeRn9kkz/MU1mAF
+jaQCrnL5eX2tk6aa4egKHPI2Pn9i9ctCxRBYP5yI+DQ5U0ih0fl+DAMYRydrrnGG
+a+DVSTpgXGivET6CjLVOkhk0F1V9JvnaMKBsMVVC61Wa/1q5Ag0Eanw7HwEQAONI
+/dmsHwynIr/9j8PVutVUwXRU/fSbU98vN4h7Tal4lxnOpQDFhbSUnDuVjR7BMQDX
+Zs6q8GRj7tcCtsb1B3C6eLQ12YMdndHnxmkUNcZtG1DiJ80WpVU+m4H0rRJvhFh9
+jov3c6/I1Bov68xQOxBfFModRui27Ro0s1VrEQRCDCIVbXJ1guoeZmzuliKtjMfv
+2wTleSnDBLGL/MFFd8BxHwBbsrKq1Ab7542/87s9js+xEE+bE9ImcUOAT4Ry9yyE
+cUzOyeJi/z/kwRxbcAm+f8CcmdvK5okV3xUN4DKz5imubLfL9/r/jWGPxPcNFUIN
+g2AIPWcujvtGEwU4+/fvGjSUL4B12cVUPUoKT9LsiJbRi4WMx4YmMOZhOKPohV+K
+wRjLsCh89oKkR7n5c2ztjgA/fzRACnSN7mZyitishUJ4E9UarpJzkCavQp5cuwTh
+9sz27pEP18rLTw7CDvardd/hsfuCRCFWyO4f7oYYo//Kn5FEUVbgSlkLaCcS+9PK
+cJnTzqk5rSNtjyzGWETO2BVtPLlD4j8FTPp69vmBinUhFilQzSZkU3i1dULfU6mE
+AoIgnfmwyQLgUzeK3gpvpLc2uAAnn6/uz8ygZ/16Iom3zbrbeQmVk7bsSEh4z5px
+6bPRKcKSNut/luIJzgU9aqU8uUmGFPU7iu11ebqLABEBAAGJAjYEGAEKACAWIQT8
+NcD6omYFxMIce7+/Q4hBReWqlAUCanw7HwIbDAAKCRC/Q4hBReWqlOg0D/4vF6y7
+VSpADc28EXZlfamaEwrIE8rKKWeuYKlN4imW5HPi0QyJv2b+6MBVu24AkrdCqWi6
+SiiKSAlbOS7a8NODpjQVNgbKdeASA9syibidM7dO6lxn3SyuCLOMNS8qnBiYkr4i
+SSk6GADuPnYVZwo7Pjx6wAndpAVrJqSVM8U5lIE1+v/JvF+JaKxMzK0TM6Q2AORV
+I/zBc1Uz0gHYKECsbmrOdgJgjLO8luMldPIb2CTAgpgn74lY3oCMyxweaPb30UGE
+sZj3+BrxhrDMKOrK7ZKHAdsSK8NeQQGlDMYUrvamxcX+FyQbUCaZXrLpX3GFxtcy
+AOhhkXLxhWKN4MW0Kl/B5VqXTz1Ro1/4exlZJBydLEYxDRJgcJ/DnUlfaxTQ1SCR
+SFM6lr5vArXjt/xA4evAJZsCFuDa6Zev/GXQsYLXi9YdFf2ERufUMd8fF5m3FJsB
+ndRfGAjrSWO6PeV8XrmkBtknVAAnT16qKUtlqTIG9rfoVWqR152U1GXHNSRDpgiN
+W+3AOWbDSKKFu/7mKmglOnUdxhOjoX+Bs4Mb+hU8Jxrm8IxWx1xSffCgTZnrrXqn
+eYf7FxGcCUhmn6WCS1gy1u/9nc5ekO0OTvNe2TBiyVFzwtr/ZHtQEJOlv/Lcd1jF
+sA2BeDVj62NOnzRGG9lMVzVtoXtM5IKVc4Erkg==
+=zwls
+-----END PGP PUBLIC KEY BLOCK-----