harden: P1/P2 improvements from CON-571 review

P1 — deploy-k8s.yaml:
- Add set -euo pipefail to all run blocks
- Replace sed-based image tag patching with yq for YAML-safe updates
- Add source commit SHA and CI run link to deploy commit messages
- Install yq v4.44.1 as prerequisite step

P1 — build-push.yaml:
- Add runner input parameter for future ARM64 self-hosted runners
  (default: ubuntu-latest with QEMU emulation)

P2 — test-python.yaml:
- Add pyproject.toml support (pip install -e) before requirements.txt fallback

P2 — build-push.yaml:
- Pin catthehacker/ubuntu container image to act-22.04 (was act-latest)

Ref: CON-578

.gitea/workflows/deploy-k8s.yaml

@@ -34,11 +34,20 @@ jobs:
     runs-on: ubuntu-latest
     if: gitea.ref == 'refs/heads/main'
     steps:
+      - name: Install yq
+        run: |
+          set -euo pipefail
+          wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_amd64
+          chmod +x /usr/local/bin/yq
+
       - name: Update image tag in cluster repo
         run: |
+          set -euo pipefail
+
           SHA="${{ gitea.sha }}"
           SHORT_SHA="${SHA:0:7}"
           IMAGE_TAG="sha-${SHORT_SHA}"
+          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
 
           git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
           cd wectrl-k8s-cluster
@@ -47,7 +56,7 @@ jobs:
           git config user.name "Gitea CI"
 
           for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
-            sed -i "s|image: ${{ inputs.image-name }}:.*|image: ${{ inputs.image-name }}:${IMAGE_TAG}|g" \
+            yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
               "${DEPLOY_PATH}"
             git add "${DEPLOY_PATH}"
           done
@@ -55,7 +64,10 @@ jobs:
           if git diff --staged --quiet; then
             echo "No image tag changes to commit"
           else
-            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
+            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}
+
+Source: ${SHA}
+Run: ${RUN_URL}"
             git push origin main
             echo "Cluster repo updated — ArgoCD will sync within ~3 min"
           fi