harden: P1/P2 improvements from CON-571 review

P1 — deploy-k8s.yaml:
- Add set -euo pipefail to all run blocks
- Replace sed-based image tag patching with yq for YAML-safe updates
- Add source commit SHA and CI run link to deploy commit messages
- Install yq v4.44.1 as prerequisite step

P1 — build-push.yaml:
- Add runner input parameter for future ARM64 self-hosted runners
  (default: ubuntu-latest with QEMU emulation)

P2 — test-python.yaml:
- Add pyproject.toml support (pip install -e) before requirements.txt fallback

P2 — build-push.yaml:
- Pin catthehacker/ubuntu container image to act-22.04 (was act-latest)

Ref: CON-578

.gitea/workflows/build-push.yaml

@@ -29,6 +29,11 @@ on:
         required: false
         type: string
         default: ""
+      runner:
+        description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
+        required: false
+        type: string
+        default: "ubuntu-latest"
     secrets:
       REGISTRY_USER:
         required: true
@@ -42,9 +47,9 @@ on:
 jobs:
   build:
     name: Build & Push
-    runs-on: ubuntu-latest
+    runs-on: ${{ inputs.runner }}
     container:
-      image: catthehacker/ubuntu:act-latest
+      image: catthehacker/ubuntu:act-22.04
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}

.gitea/workflows/deploy-k8s.yaml

@@ -34,11 +34,20 @@ jobs:
     runs-on: ubuntu-latest
     if: gitea.ref == 'refs/heads/main'
     steps:
+      - name: Install yq
+        run: |
+          set -euo pipefail
+          wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_amd64
+          chmod +x /usr/local/bin/yq
+
       - name: Update image tag in cluster repo
         run: |
+          set -euo pipefail
+
           SHA="${{ gitea.sha }}"
           SHORT_SHA="${SHA:0:7}"
           IMAGE_TAG="sha-${SHORT_SHA}"
+          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
 
           git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
           cd wectrl-k8s-cluster
@@ -47,7 +56,7 @@ jobs:
           git config user.name "Gitea CI"
 
           for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
-            sed -i "s|image: ${{ inputs.image-name }}:.*|image: ${{ inputs.image-name }}:${IMAGE_TAG}|g" \
+            yq -i '(.spec.template.spec.containers[].image | select(test("^${{ inputs.image-name }}:"))) = "${{ inputs.image-name }}:'"${IMAGE_TAG}"'"' \
               "${DEPLOY_PATH}"
             git add "${DEPLOY_PATH}"
           done
@@ -55,7 +64,10 @@ jobs:
           if git diff --staged --quiet; then
             echo "No image tag changes to commit"
           else
-            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
+            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}
+
+Source: ${SHA}
+Run: ${RUN_URL}"
             git push origin main
             echo "Cluster repo updated — ArgoCD will sync within ~3 min"
           fi

.gitea/workflows/test-python.yaml

@@ -39,6 +39,9 @@ jobs:
         run: |
           if [ -n "${{ inputs.install-command }}" ]; then
             ${{ inputs.install-command }}
+          elif [ -f "${{ inputs.working-directory }}/pyproject.toml" ]; then
+            pip install -e "${{ inputs.working-directory }}"
+            pip install pytest pytest-asyncio
           elif [ -f "${{ inputs.working-directory }}/requirements.txt" ]; then
             pip install -r ${{ inputs.working-directory }}/requirements.txt
             pip install pytest pytest-asyncio