feat: add reusable CI/CD pipeline templates

Reusable Gitea Actions workflows for lint, test, build, and deploy:
- lint-python, lint-node, lint-rust
- test-python, test-node, test-rust
- build-push (Docker build + push to Gitea registry)
- deploy-k8s (GitOps image tag update in cluster repo)

Plus example caller workflows for python-fullstack, rust-service,
and node-frontend stacks. Branch refs aligned to staging per CON-570 standards.

.gitea/workflows/deploy-k8s.yaml

@@ -0,0 +1,61 @@
+# Reusable workflow: Update image tag in wectrl-k8s-cluster repo (GitOps deploy)
+# Usage: uses: wectrl-net/ci-templates/.gitea/workflows/deploy-k8s.yaml@main
+name: Deploy to K8s (GitOps)
+
+on:
+  workflow_call:
+    inputs:
+      image-name:
+        description: "Full image name (e.g. git.wectrl.net/wectrl-net/my-service)"
+        required: true
+        type: string
+      deploy-paths:
+        description: "Space-separated paths to deployment manifests in the k8s cluster repo"
+        required: true
+        type: string
+      service-name:
+        description: "Service name for commit message (e.g. h1per-pms)"
+        required: true
+        type: string
+      k8s-repo:
+        description: "K8s cluster repo (org/repo)"
+        required: false
+        type: string
+        default: "wectrl-net/wectrl-k8s-cluster"
+    secrets:
+      GIT_USER:
+        required: true
+      GIT_TOKEN:
+        required: true
+
+jobs:
+  deploy:
+    name: Update k8s Cluster Repo
+    runs-on: ubuntu-latest
+    if: gitea.ref == 'refs/heads/main'
+    steps:
+      - name: Update image tag in cluster repo
+        run: |
+          SHA="${{ gitea.sha }}"
+          SHORT_SHA="${SHA:0:7}"
+          IMAGE_TAG="sha-${SHORT_SHA}"
+
+          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
+          cd wectrl-k8s-cluster
+
+          git config user.email "ci@wectrl.net"
+          git config user.name "Gitea CI"
+
+          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
+            sed -i "s|image: ${{ inputs.image-name }}:.*|image: ${{ inputs.image-name }}:${IMAGE_TAG}|g" \
+              "${DEPLOY_PATH}"
+            git add "${DEPLOY_PATH}"
+          done
+
+          if git diff --staged --quiet; then
+            echo "No image tag changes to commit"
+          else
+            git commit -m "deploy: ${{ inputs.service-name }} ${IMAGE_TAG}"
+            git push origin main
+            echo "Cluster repo updated — ArgoCD will sync within ~3 min"
+          fi