Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

roadmap/phases.md

@@ -77,6 +77,9 @@ survives rebuild; default-deny + `egress` apply to the VM; guest auto-updates.
 ## Phase 6 — Service Catalog Onboarding + C2 UI
 **Entry:** Phases 2–4 done.
 **Do:** onboard the 13 services via ServiceDefinitions in dependency order (see workstream WS-APPS);
+**bring Gitea online early in this phase** and cut the GitOps source + CI/CD over to it (Gitea
+Actions running the Kyverno gate + Chainsaw conformance Job; PRs as the enforced merge gate —
+[`../docs/05-gitops-and-delivery.md`](../docs/05-gitops-and-delivery.md), [`../CONTRIBUTING.md`](../CONTRIBUTING.md));
 stand up the C2 UI (Homepage root + Grafana + Headlamp + Flux status).
 **Exit (demonstrate):** each service fully wired from its ServiceDefinition (compute/storage/policy/
 egress/TLS/DNS/monitoring/updates) with default-deny + correct egress; the arr↔qbittorrent↔jackett↔

roadmap/workstreams.md

@@ -50,10 +50,19 @@ only via [`../agents/coordination-protocol.md`](../agents/coordination-protocol.
 - WS-C2 is last-ish (Phase 6) since it aggregates everything.
 
 ## WS-APPS onboarding order (respect dependencies from [13](../docs/13-service-catalog.md))
-1. **pihole** (DNS underpinning) → 2. **plex** (largest; validates bulk tier + public exposure) →
-3. **qbittorrent, jackett** (VPN + kill-switch proof) → 4. **sonarr, radarr** (VPN + arr↔downloader
-allows) → 5. **seerr** (cross-service allows to arr + plex) → 6. **nextcloud, gitea** (DR-critical
-data + backups) → 7. **minecraft, unifi, semaphore, kasm** (remaining).
+1. **pihole** (DNS underpinning) →
+2. **gitea** — **bootstrapping-critical; brought online early** so the platform self-hosts its git
+   and CI/CD; after it is stable, WS-GITOPS cuts Flux's source over to Gitea and moves CI to Gitea
+   Actions ([`../docs/05-gitops-and-delivery.md`](../docs/05-gitops-and-delivery.md),
+   [`../CONTRIBUTING.md`](../CONTRIBUTING.md)). DR-critical → off-cluster backup + mirror. →
+3. **plex** (largest; validates bulk tier + public exposure) →
+4. **qbittorrent, jackett** (VPN + kill-switch proof) → 5. **sonarr, radarr** (VPN + arr↔downloader
+allows) → 6. **seerr** (cross-service allows to arr + plex) → 7. **nextcloud** (DR-critical data +
+backups) → 8. **minecraft, unifi, semaphore, kasm** (remaining).
+
+**GitOps source migration** (WS-GITOPS, tied to step 2): local bootstrap source → self-hosted Gitea;
+CI (Kyverno gate + Chainsaw conformance Job trigger) moves to Gitea Actions; PRs become the enforced
+merge gate into `main`.
 
 Each onboarding is a full acceptance-gate pass ([`../agents/definition-of-done.md`](../agents/definition-of-done.md)),
 not just a merged manifest.