Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/13-service-catalog.md

@@ -75,7 +75,7 @@ Egress and dependencies below are **normative intent**; implementers render the
 | 9 | **unifi** | container | internal | internet | config: longhorn | — | UniFi network controller |
 | 10 | **semaphore** | container | internal | internet | config/db: longhorn | — | Ansible UI |
 | 11 | **kasm** | container | internal | internet | config: longhorn | — | Kasm Workspaces (may need more resources; container-first, VM if required) |
-| 12 | **gitea** | container | public | internet | repos/db: longhorn (irreplaceable → backed up) | — | Git hosting; DR-critical |
+| 12 | **gitea** | container | public | internet | repos/db: longhorn (irreplaceable → backed up) | — | Git hosting; **bootstrapping-critical** — self-hosts the platform's GitOps source + CI/CD; onboarded **early** (see below); DR-critical (off-cluster backup + mirror) |
 | 13 | **qbittorrent** | container | internal | **vpn** | config: longhorn; downloads: **bulk** | ← sonarr, ← radarr | VPN + kill-switch; download client |
 
 **VPN-class set (R-NET-05/06):** sonarr, radarr, jackett, qbittorrent — all egress via VPN with an
@@ -103,6 +103,12 @@ and inherit all guarantees automatically — that is the point of the abstractio
   ([09](09-dns-and-ingress.md)); everything else stays `internal`.
 - **Kasm** is resource-heavy and may be a candidate for `kind: vm` if container mode proves
   insufficient — the ServiceDefinition makes that a one-field change.
+- **Gitea is bootstrapping-critical.** The platform self-hosts its git and CI/CD, so Gitea is brought
+  online **early** (WS-APPS step 2, right after PiHole). Once stable, the GitOps source and CI move
+  from the local bootstrap source to Gitea + Gitea Actions ([05](05-gitops-and-delivery.md),
+  [`../CONTRIBUTING.md`](../CONTRIBUTING.md)). Because a cluster loss would take its own git host with
+  it, Gitea's repos/DB are backed up **off-cluster** and mirrored, so the platform can always be
+  rebuilt from a source that outlives the cluster.
 
 ## Acceptance gates
 - Each service is fully wired from its ServiceDefinition alone (compute, storage, policy, egress,