Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

renovate.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "skipInstalls": true,
+  "ignoreScripts": true,
+  "ignorePaths": ["**/.github/**", "**/.gitea/**"],
+  "osvVulnerabilityAlerts": true,
+  "reviewers": ["f.weber"],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "aptly itself — bump ARG APTLY_VERSION in the server image",
+      "managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
+      "matchStrings": ["ARG APTLY_VERSION=(?<currentValue>\\S+)"],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "aptly-dev/aptly",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    },
+    {
+      "customType": "regex",
+      "description": "yq (config rendering helper baked into the aptly-server image)",
+      "managerFilePatterns": ["/^images/aptly-server/Dockerfile$/"],
+      "matchStrings": ["ARG YQ_VERSION=(?<currentValue>\\S+)"],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "mikefarah/yq"
+    },
+    {
+      "customType": "regex",
+      "description": "nfpm (deb-builder image)",
+      "managerFilePatterns": ["/^images/aptly-deb-builder/Dockerfile$/"],
+      "matchStrings": ["ARG NFPM_VERSION=(?<currentValue>\\S+)"],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "goreleaser/nfpm"
+    },
+    {
+      "customType": "regex",
+      "description": "pinned Helm CLI version used across Gitea workflows",
+      "managerFilePatterns": ["/^\\.gitea/workflows/.*\\.yaml$/"],
+      "matchStrings": ["HELM_VERSION \\|\\| '(?<currentValue>[^']+)'"],
+      "datasourceTemplate": "github-releases",
+      "depNameTemplate": "helm/helm",
+      "extractVersionTemplate": "^v(?<version>.*)$"
+    }
+  ],
+  "packageRules": [
+    {
+      "description": "the yq/nfpm sha256 pins in the Dockerfiles are updated by hand alongside the version bump (see the ARG lines directly above each), not by Renovate — flag PRs so a human re-pins them",
+      "matchDepNames": ["mikefarah/yq", "goreleaser/nfpm"],
+      "commitMessageSuffix": "(re-pin the matching SHA256_AMD64/ARM64 ARG lines by hand — see images/*/Dockerfile)"
+    }
+  ]
+}