Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/05-gitops-and-delivery.md

@@ -80,6 +80,28 @@ Full detail and the "is an automated commit a GitOps change?" nuance is in
 - Because desired state is in git and data is on Longhorn/backups, a rebuilt cluster reconverges by
   re-bootstrapping Flux and restoring volumes ([04](04-storage-and-state.md)).
 
+## Source-of-truth: local bootstrap → self-hosted Gitea
+
+The platform hosts its own git, which creates a deliberate bootstrapping sequence
+([`../CONTRIBUTING.md`](../CONTRIBUTING.md)):
+
+1. **Bootstrap source.** Initially there is no remote git on this network (the prior `home-network`
+   Gitea is gone from here). Development is local; the cluster is first reconciled from a
+   **bootstrap source** (this local repo / an out-of-band source).
+2. **Gitea comes online early.** **Gitea is one of the first services onboarded** ([13](13-service-catalog.md))
+   so the platform gains its own git host at `gitea.home.keithjackson.dev`.
+3. **Cut Flux over to Gitea.** Once Gitea is stable, Flux's `GitRepository` source is migrated from
+   the bootstrap source to Gitea; the platform then reconciles from its own git.
+4. **CI/CD moves to Gitea Actions.** The Kyverno L0 policy gate and the trigger for the in-cluster
+   Chainsaw conformance Job ([14](14-testing-and-conformance.md)) run as Gitea Actions pipelines on
+   push/PR; PRs become the enforced merge gate into `main`.
+
+**Circularity & DR.** Gitea runs *on* the cluster Flux reconciles *from* Gitea. Mitigations:
+- Keep an **off-cluster mirror** of the platform repo so a source-of-truth exists that outlives the
+  cluster.
+- Treat **Gitea as DR-critical**: its repos/DB are backed up off-cluster ([04](04-storage-and-state.md)),
+  so a cluster loss never loses the git history needed to rebuild the platform.
+
 ## Guardrails
 - No `kubectl apply` of app state by hand — everything flows through git/Flux (R-GITOPS-01, click-
   ops-never per [AGENTS.md](../AGENTS.md)).