feat: add Tekton Pipelines for integration testing

Implement Kubernetes-native CI/CD with Tekton Pipelines:

ARCHITECTURE:
- Tekton Task: Runs integration tests in container
- Tekton Pipeline: Orchestrates test execution
- ArgoCD Application: Manages Tekton installation
- CI: Triggers PipelineRun, reads results, promotes image

FLOW:
1. CI builds image:sha
2. CI creates PipelineRun with new image
3. Tekton controller watches PipelineRun
4. Task executes integration tests
5. Results written to PipelineRun status
6. CI reads status, promotes to :latest if pass
7. ArgoCD detects :latest change and deploys

BENEFITS:
✓ Kubernetes-native (CRDs, no external dependencies)
✓ DRY (parameterized Task/Pipeline)
✓ SOLID (single responsibility, clean interfaces)
✓ GitOps (Tekton managed by ArgoCD)
✓ Observable (logs, status, results)
✓ Secure (non-root, resource limits)

FILES:
- k8s/tekton/task-integration-test.yaml: Task definition
- k8s/tekton/pipeline-integration-test.yaml: Pipeline definition
- k8s/tekton/kustomization.yaml: Kustomize management
- k8s/tekton/README.md: Documentation
- k8s/argocd-apps/tekton.yaml: ArgoCD Application
- .gitea/workflows/ci.yaml: Updated CI to use Tekton

NEXT:
1. Merge PR
2. ArgoCD syncs and installs Tekton
3. First git push triggers PipelineRun
4. Integration tests run in cluster
5. Results feedback to CI

k8s/tekton/base/tekton-release.yaml

@@ -0,0 +1,44 @@
+# Tekton Pipelines Release manifest
+# Source: https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
+# This is managed by ArgoCD - do NOT manually apply
+# ArgoCD syncs this from git
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tekton-pipelines
+  labels:
+    managed-by: argocd
+
+---
+# CRDs and RBAC are part of the full release manifest
+# Using a reference approach for cleaner GitOps
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: tekton-pipelines
+  namespace: argocd
+spec:
+  generators:
+  - list:
+      elements:
+      - name: tekton-pipelines
+  template:
+    metadata:
+      name: tekton-pipelines
+      namespace: argocd
+    spec:
+      project: default
+      source:
+        repoURL: https://github.com/tektoncd/operator
+        targetRevision: main
+        path: config/release
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: tekton-pipelines
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+        - CreateNamespace=true