harden: P1/P2 improvements from CON-571 review

P1 — deploy-k8s.yaml:
- Add set -euo pipefail to all run blocks
- Replace sed-based image tag patching with yq for YAML-safe updates
- Add source commit SHA and CI run link to deploy commit messages
- Install yq v4.44.1 as prerequisite step

P1 — build-push.yaml:
- Add runner input parameter for future ARM64 self-hosted runners
  (default: ubuntu-latest with QEMU emulation)

P2 — test-python.yaml:
- Add pyproject.toml support (pip install -e) before requirements.txt fallback

P2 — build-push.yaml:
- Pin catthehacker/ubuntu container image to act-22.04 (was act-latest)

Ref: CON-578

.gitea/workflows/build-push.yaml

@@ -29,6 +29,11 @@ on:
         required: false
         type: string
         default: ""
+      runner:
+        description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
+        required: false
+        type: string
+        default: "ubuntu-latest"
     secrets:
       REGISTRY_USER:
         required: true
@@ -42,9 +47,9 @@ on:
 jobs:
   build:
     name: Build & Push
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     container:
-      image: catthehacker/ubuntu:act-latest
+      image: catthehacker/ubuntu:act-22.04
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}