Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

pubkeys/README.md

@@ -0,0 +1,62 @@
+# Public keys
+
+## Chart signing key (needed, not yet set up)
+
+`.gitea/workflows/release-chart.yaml` runs `helm package --sign` to produce a
+`.tgz.prov` file for every chart release, and `charts/aptly/Chart.yaml` is meant to
+carry an `artifacthub.io/signKey` annotation pointing at the public half of that
+key (both are currently commented out / referencing a placeholder — see below).
+
+**This key must NOT be Ed25519/EdDSA.** Helm's chart signing is built on the
+deprecated `golang.org/x/crypto/openpgp` library, which cannot read Ed25519 keys at
+all — signing fails with `Error: private key not found` (or, depending on gpg
+version, `openpgp: unsupported feature: public key type: 22`). This is a
+long-standing, unresolved upstream limitation (helm/helm#11634, #31180, #31181), not
+a configuration mistake — confirmed by reproducing it locally against a throwaway
+Ed25519 test key before writing this note. Use **RSA** (4096-bit, no expiry is
+fine for a CI signing key) or a classic ECC curve helm's openpgp fork supports;
+RSA is the safest choice since it's unambiguously supported.
+
+The org's existing "Morlana CI Signing Key" (used by e.g. `bookstack-chart`) is
+Ed25519 and was tried here first — it does not work for this purpose. It may still
+be perfectly valid for other things (signing an actual apt repository via
+`aptly.gpg.signingKey`, which is a completely different code path that does support
+Ed25519 — see [docs/packaging.md](../docs/packaging.md#gpg) — just not for
+`helm package --sign`. This repo therefore needs its own, separate, RSA key
+dedicated to chart-package signing.
+
+### Generating it
+
+Run this yourself (locally, not in CI) so the private key material never has to
+pass through anything but your own machine and the Gitea secrets store:
+
+```bash
+gpg --full-generate-key
+# RSA and RSA (default)
+# 4096 bit
+# key does not expire (or a long expiry — a CI signing key you'd have to rotate
+# on a schedule is more operational overhead than it's worth here)
+# Name: Aptly Chart Signing Key
+# Email: something you control, e.g. contact+development@morlana.net
+
+gpg --list-secret-keys --with-colons | awk -F: '$1=="sec"{print $5}'   # -> the key ID
+gpg --armor --export <key-id> > pubkeys/chart-signing.asc
+gpg --armor --export-secret-keys <key-id>                              # -> paste as GPG_PRIVATE_KEY
+```
+
+Then, in the repo's Gitea settings:
+- Secret **`GPG_PRIVATE_KEY`** — the armored output of the last command above
+- Secret **`GPG_PASSPHRASE`** — whatever passphrase you set (empty string if none)
+- Secret **`GPG_KEY_ID`** — the key ID or fingerprint from `gpg --list-secret-keys`
+
+Commit `pubkeys/chart-signing.asc`, then uncomment the `artifacthub.io/signKey`
+block in `charts/aptly/Chart.yaml` with the real fingerprint, and uncomment
+`pubkeys/chart-signing.asc` in `release-chart.yaml`'s release-assets step.
+
+### Verifying a downloaded chart (once the key exists)
+
+```bash
+gpg --import pubkeys/chart-signing.asc
+gpg --export > /tmp/pubring.gpg   # legacy binary format — helm can't read pubring.kbx
+helm verify aptly-<version>.tgz --keyring /tmp/pubring.gpg
+```