feat: add GitOps workflow — branch strategy, PR template, deploy/rollback scripts, CI skeleton

- docs/GITOPS.md: complete workflow from prototype to production
- .gitea/pull_request_template.md: pre-merge checklist for swarm PR review
- scripts/deploy.sh: tag-based deployment to all 6 CTs with health checks
- scripts/rollback.sh: rollback to previous tag
- .gitea/workflows/ci.yml: CI pipeline (activates when Actions runners available)
- .gitignore: prevent config.yaml and secrets from being committed
- .gitattributes: consistent LF line endings across platforms

.gitea/pull_request_template.md

@@ -0,0 +1,31 @@
+## Description
+<!-- What does this PR do? Which issue does it close? -->
+
+Closes #
+
+## Type
+- [ ] feat — new feature (MINOR version bump)
+- [ ] fix — bug fix (PATCH version bump)
+- [ ] docs — documentation only
+- [ ] refactor — code restructuring (no behavior change)
+
+## Platform(s) Affected
+- [ ] Hermes Python (Tanko, Mumuni, Koonimo, Koby)
+- [ ] pi TypeScript (Abiba)
+- [ ] Agent Zero (kagentz)
+- [ ] Shared infrastructure (config, deploy, docs)
+
+## Pre-Merge Checklist
+- [ ] Config schema validated against `config.yaml.example`
+- [ ] Plugin starts and connects to Zulip on affected CT(s)
+- [ ] Health endpoint returns 200
+- [ ] @mention detection works (bot receives own mentions)
+- [ ] Error handling: timeout produces graceful message
+- [ ] No API keys or secrets in code
+- [ ] ADRs referenced if decision changed
+
+## Testing
+<!-- How was this tested? Which CT(s)? -->
+
+## Screenshots / Logs
+<!-- If applicable -->