feat: add GitOps workflow — branch strategy, PR template, deploy/rollback scripts, CI skeleton

- docs/GITOPS.md: complete workflow from prototype to production
- .gitea/pull_request_template.md: pre-merge checklist for swarm PR review
- scripts/deploy.sh: tag-based deployment to all 6 CTs with health checks
- scripts/rollback.sh: rollback to previous tag
- .gitea/workflows/ci.yml: CI pipeline (activates when Actions runners available)
- .gitignore: prevent config.yaml and secrets from being committed
- .gitattributes: consistent LF line endings across platforms

.gitea/pull_request_template.md

@@ -0,0 +1,31 @@
+## Description
+<!-- What does this PR do? Which issue does it close? -->
+
+Closes #
+
+## Type
+- [ ] feat — new feature (MINOR version bump)
+- [ ] fix — bug fix (PATCH version bump)
+- [ ] docs — documentation only
+- [ ] refactor — code restructuring (no behavior change)
+
+## Platform(s) Affected
+- [ ] Hermes Python (Tanko, Mumuni, Koonimo, Koby)
+- [ ] pi TypeScript (Abiba)
+- [ ] Agent Zero (kagentz)
+- [ ] Shared infrastructure (config, deploy, docs)
+
+## Pre-Merge Checklist
+- [ ] Config schema validated against `config.yaml.example`
+- [ ] Plugin starts and connects to Zulip on affected CT(s)
+- [ ] Health endpoint returns 200
+- [ ] @mention detection works (bot receives own mentions)
+- [ ] Error handling: timeout produces graceful message
+- [ ] No API keys or secrets in code
+- [ ] ADRs referenced if decision changed
+
+## Testing
+<!-- How was this tested? Which CT(s)? -->
+
+## Screenshots / Logs
+<!-- If applicable -->

.gitea/workflows/ci.yml

@@ -0,0 +1,36 @@
+# Gitea Actions CI — zulip-platform-plugins
+# Activates when Gitea Actions runners are configured.
+# Until then, use manual pre-merge checklist in PR template.
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate shared config schema
+        run: |
+          python3 -c "import yaml; cfg = yaml.safe_load(open('config.yaml.example')); assert 'agent' in cfg; assert 'zulip' in cfg"
+
+      - name: Python lint (Hermes + Agent Zero)
+        run: |
+          pip install ruff
+          ruff check hermes-zulip-plugin/ agent-zero-plugin/
+
+      - name: TypeScript check (pi extension)
+        run: |
+          cd pi-zulip-extension
+          npm ci
+          npx tsc --noEmit
+
+      - name: Check no secrets committed
+        run: |
+          ! grep -r "api_key.*[A-Za-z0-9]\{20,\}" --include="*.py" --include="*.ts" --include="*.yaml" . || echo "WARNING: possible API key in code"