ci: migrate from GitHub Actions to Gitea Actions

Move workflows to .gitea/workflows and adapt for git.farh.net:
- Push container images to git.farh.net instead of GHCR/Docker Hub
- Publish Helm chart as OCI artifact (no gh-pages, Gitea lacks Pages)
- Replace cosign keyless signing with key-based (COSIGN_PRIVATE_KEY/PASSWORD/PUBLIC_KEY)
- Swap @semantic-release/github for semantic-release-gitea
- Drop gh CLI from rollback workflow
- Use GITEA_TOKEN for registry auth and release creation
- Add Artifact Hub annotations to Chart.yaml
- Run on ubuntu-latest

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/helm-release.yml

@@ -0,0 +1,41 @@
+name: Helm Chart Release
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'charts/hightower/**'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  release:
+    name: Lint, package & push OCI
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install Helm
+        uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
+
+      - name: Lint chart
+        run: helm lint charts/hightower
+
+      - name: Package chart
+        run: |
+          mkdir -p .helm-packages
+          helm package charts/hightower -d .helm-packages
+
+      - name: Log in to Gitea OCI registry
+        run: |
+          echo "${{ secrets.GITEA_TOKEN }}" | helm registry login git.farh.net \
+            --username "${{ github.actor }}" \
+            --password-stdin
+
+      - name: Push chart to Gitea OCI registry
+        run: |
+          PACKAGE=$(ls .helm-packages/*.tgz | head -1)
+          helm push "$PACKAGE" oci://git.farh.net/farhoodlabs/charts