Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

rootfs/usr/local/bin/aptly-entrypoint

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Entrypoint for the aptly-server image. Everything derived (rendered config,
+# GPG keyring, htpasswd) is expected to already exist under APTLY_RUN_DIR,
+# written by aptly-init in a preceding initContainer / compose service.
+#
+# Any argument other than "aptly api serve" (the default) is exec'd verbatim,
+# so the same image is also usable as a one-off CLI/debug container:
+#   docker run --rm -it aptly-server bash
+#   docker run --rm aptly-server aptly version
+set -euo pipefail
+
+APTLY_ROOT_DIR="${APTLY_ROOT_DIR:-/var/lib/aptly}"
+APTLY_RUN_DIR="${APTLY_RUN_DIR:-/run/aptly}"
+APTLY_CONFIG="${APTLY_CONFIG:-${APTLY_RUN_DIR}/aptly.yaml}"
+APTLY_API_LISTEN="${APTLY_API_LISTEN:-127.0.0.1:8080}"
+
+mkdir -p "${APTLY_ROOT_DIR}"
+
+if [[ "$#" -eq 0 ]]; then
+  set -- aptly api serve "-listen=${APTLY_API_LISTEN}" "-config=${APTLY_CONFIG}"
+elif [[ "$1" == "aptly" && "$#" -eq 1 ]]; then
+  set -- aptly api serve "-listen=${APTLY_API_LISTEN}" "-config=${APTLY_CONFIG}"
+fi
+
+exec "$@"