feat: add GitOps workflow — branch strategy, PR template, deploy/rollback scripts, CI skeleton

- docs/GITOPS.md: complete workflow from prototype to production
- .gitea/pull_request_template.md: pre-merge checklist for swarm PR review
- scripts/deploy.sh: tag-based deployment to all 6 CTs with health checks
- scripts/rollback.sh: rollback to previous tag
- .gitea/workflows/ci.yml: CI pipeline (activates when Actions runners available)
- .gitignore: prevent config.yaml and secrets from being committed
- .gitattributes: consistent LF line endings across platforms

.gitea/workflows/ci.yml

@@ -0,0 +1,36 @@
+# Gitea Actions CI — zulip-platform-plugins
+# Activates when Gitea Actions runners are configured.
+# Until then, use manual pre-merge checklist in PR template.
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Validate shared config schema
+        run: |
+          python3 -c "import yaml; cfg = yaml.safe_load(open('config.yaml.example')); assert 'agent' in cfg; assert 'zulip' in cfg"
+
+      - name: Python lint (Hermes + Agent Zero)
+        run: |
+          pip install ruff
+          ruff check hermes-zulip-plugin/ agent-zero-plugin/
+
+      - name: TypeScript check (pi extension)
+        run: |
+          cd pi-zulip-extension
+          npm ci
+          npx tsc --noEmit
+
+      - name: Check no secrets committed
+        run: |
+          ! grep -r "api_key.*[A-Za-z0-9]\{20,\}" --include="*.py" --include="*.ts" --include="*.yaml" . || echo "WARNING: possible API key in code"