Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

AGENTS.md

@@ -146,3 +146,16 @@ This is a hard boundary (R-TEST-06):
 
 The point: the specification is the fixed target. Agents move the implementation and its tests
 toward the target; they never move the target.
+
+## 12. Version-control workflow
+
+Full detail in [`CONTRIBUTING.md`](CONTRIBUTING.md). The rules that bind every change:
+
+- **No work on `main`.** `main` holds only completed, reviewed work.
+- **Every change is a feature branch** (`feature/…`, `fix/…`, `docs/…`, `chore/…`), **merged into
+  `main`** when complete (and, for implementation, when its conformance tests pass).
+- **Local git for now; Gitea soon.** There is no remote host on this network yet — the prior
+  `home-network` Gitea is gone from this network. **Gitea is one of the first services brought online
+  on the cluster**, after which repos, the GitOps source, and CI/CD move to Gitea (Gitea Actions
+  running the Kyverno gate + Chainsaw conformance Job, with PRs as the enforced merge gate).
+- **Never commit plaintext secrets** (SOPS-encrypted only, [`docs/07-security-and-secrets.md`](docs/07-security-and-secrets.md)).