Establish dev workflow (feature-branch→main) and pull Gitea bootstrap earlier

- Add CONTRIBUTING.md: interim local-git rules (no work on main; every change
  a feature branch merged into main) and the target state (Gitea-hosted repos,
  GitOps source cutover, CI/CD via Gitea Actions running the Kyverno gate +
  Chainsaw conformance Job, PR merge gate). Note the self-hosted-git
  bootstrapping circularity + off-cluster mirror/backup mitigation.
- AGENTS.md: add section 12 (version-control workflow).
- docs/05: source-of-truth migration (local bootstrap -> self-hosted Gitea).
- docs/13 + roadmap: reprioritize Gitea as bootstrapping-critical, onboarded
  early (WS-APPS step 2); nextcloud onboarding split out.
- task-board: T-6.1a (gitea early), T-6.1b (source+CI migration to Gitea).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

roadmap/phases.md

@@ -77,6 +77,9 @@ survives rebuild; default-deny + `egress` apply to the VM; guest auto-updates.
 ## Phase 6 — Service Catalog Onboarding + C2 UI
 **Entry:** Phases 2–4 done.
 **Do:** onboard the 13 services via ServiceDefinitions in dependency order (see workstream WS-APPS);
+**bring Gitea online early in this phase** and cut the GitOps source + CI/CD over to it (Gitea
+Actions running the Kyverno gate + Chainsaw conformance Job; PRs as the enforced merge gate —
+[`../docs/05-gitops-and-delivery.md`](../docs/05-gitops-and-delivery.md), [`../CONTRIBUTING.md`](../CONTRIBUTING.md));
 stand up the C2 UI (Homepage root + Grafana + Headlamp + Flux status).
 **Exit (demonstrate):** each service fully wired from its ServiceDefinition (compute/storage/policy/
 egress/TLS/DNS/monitoring/updates) with default-deny + correct egress; the arr↔qbittorrent↔jackett↔