Initial implementation: aptly container image, Compose stacks, Helm chart, and Gitea Actions pipelines

Provides a self-contained, containerized aptly (Debian repo manager)
stack with independently releasable image and Helm chart versions.

- images/: aptly-server (aptly built from source, cross-compiled) and
  aptly-deb-builder (nfpm + dpkg-buildpackage) container images
- rootfs/: shared aptly-init/aptly-reconcile/aptly-push/aptly-pack
  scripts consumed identically by Compose and the Helm chart, driven
  by one declarative state.yaml contract
- compose/: test (ephemeral, open) and production docker-compose
  stacks with an nginx read/auth sidecar
- charts/aptly/: aptly-native Helm chart covering every security
  posture from fully open to authenticated read+write, Ingress and
  Gateway API support (usable in parallel for migration scenarios),
  metrics, and declarative repo/mirror/publish reconciliation via a
  Helm hook
- .gitea/workflows/: CI (lint, template, kubeconform, E2E smoke test)
  plus separately tagged image (image/v*) and chart (chart/v*)
  releases, weekly rebuilds, and a preflight workflow validating the
  runner's Docker/Helm-OCI capabilities
- pubkeys/: RSA chart-signing key for Helm --sign / Artifact Hub's
  signKey annotation (Helm can't verify Ed25519 keys)
- docs/, README.md, charts/aptly/README.md: usage, security, and
  versioning documentation

rootfs/usr/local/bin/aptly-release

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# aptly-release — aptly-pack + aptly-push in one call. The whole point of the
+# deb-builder image: one command turns a source tree into a package on the
+# repo, whichever of the four security presets is in effect.
+#
+# Usage: aptly-release [aptly-pack flags] -- [aptly-push flags]
+# Anything before "--" goes to aptly-pack; anything after goes to aptly-push
+# (files are appended automatically, do not pass them yourself).
+#
+# Example:
+#   aptly-release --config nfpm.yaml -- --repo stable --distribution stable
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+log() { printf '[aptly-release] %s\n' "$*" >&2; }
+
+pack_args=()
+push_args=()
+target=pack_args
+for a in "$@"; do
+  if [[ "$a" == "--" && "$target" == "pack_args" ]]; then
+    target=push_args
+    continue
+  fi
+  if [[ "$target" == "pack_args" ]]; then pack_args+=("$a"); else push_args+=("$a"); fi
+done
+
+log "packaging..."
+mapfile -t debs < <("${SCRIPT_DIR}/aptly-pack" "${pack_args[@]}")
+[[ "${#debs[@]}" -gt 0 ]] || { log "aptly-pack produced no output"; exit 1; }
+for d in "${debs[@]}"; do log "  built: ${d}"; done
+
+log "pushing..."
+exec "${SCRIPT_DIR}/aptly-push" "${push_args[@]}" "${debs[@]}"