harden: P1/P2 improvements from CON-571 review

P1 — deploy-k8s.yaml:
- Add set -euo pipefail to all run blocks
- Replace sed-based image tag patching with yq for YAML-safe updates
- Add source commit SHA and CI run link to deploy commit messages
- Install yq v4.44.1 as prerequisite step

P1 — build-push.yaml:
- Add runner input parameter for future ARM64 self-hosted runners
  (default: ubuntu-latest with QEMU emulation)

P2 — test-python.yaml:
- Add pyproject.toml support (pip install -e) before requirements.txt fallback

P2 — build-push.yaml:
- Pin catthehacker/ubuntu container image to act-22.04 (was act-latest)

Ref: CON-578

.gitea/workflows/test-python.yaml

@@ -39,6 +39,9 @@ jobs:
         run: |
           if [ -n "${{ inputs.install-command }}" ]; then
             ${{ inputs.install-command }}
+          elif [ -f "${{ inputs.working-directory }}/pyproject.toml" ]; then
+            pip install -e "${{ inputs.working-directory }}"
+            pip install pytest pytest-asyncio
           elif [ -f "${{ inputs.working-directory }}/requirements.txt" ]; then
             pip install -r ${{ inputs.working-directory }}/requirements.txt
             pip install pytest pytest-asyncio