feat: add Tekton Pipelines for CI/CD orchestration

Install Tekton Pipelines via ArgoCD for Kubernetes-native CI/CD:

COMPONENTS:
- Tekton Pipelines: CNCF-standard test orchestration
- Task/Pipeline CRDs: Reusable workflow definitions
- PipelineRun: Ephemeral execution instances
- ArgoCD Application: GitOps-managed installation

INTEGRATION:
- homelab-frontend CI triggers PipelineRun via Kubernetes API
- Tests run in cluster against actual services
- Results flow back to CI for pass/fail decisions
- Image promotion only on test success

FILES:
- k8s/infra/tekton/: Tekton infrastructure setup
  - namespace.yaml: tekton-pipelines namespace
  - kustomization.yaml: Release manifest reference
- k8s/argocd/apps/06-ci-cd.yaml: ArgoCD Application
- k8s/argocd/projects/homelab-project.yaml: Added Tekton repos

WAVE ORDERING:
Wave 06 (CI/CD) is deployed after:
  - Wave 05 (Networking)
  - Wave 04 (Core components)
But before Wave 40+ (Applications)

BENEFITS:
✓ Kubernetes-native (no external CI runners)
✓ GitOps-managed (everything in git via ArgoCD)
✓ CNCF-standard (industry-proven Tekton project)
✓ Pre-merge testing (tests must pass before deploy)
✓ Observable (logs, status, results tracking)
✓ Secure (non-root, resource limits, RBAC)

k8s/argocd/apps/06-ci-cd.yaml

@@ -0,0 +1,46 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: tekton-pipelines
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: tekton-pipelines
+    app.kubernetes.io/part-of: homelab-infra
+    wave: "06"
+spec:
+  project: homelab
+  
+  source:
+    repoURL: https://github.com/tektoncd/pipeline.git
+    targetRevision: main
+    path: config/release
+  
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: tekton-pipelines
+  
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+    - Validate=false
+    - RespectIgnoreDifferences=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
+  
+  ignoreDifferences:
+  # Ignore webhook certificate changes (managed by cert-manager)
+  - group: admissionregistration.k8s.io
+    kind: ValidatingWebhookConfiguration
+    jsonPointers:
+    - /webhooks/0/clientConfig/caBundle
+  - group: admissionregistration.k8s.io
+    kind: MutatingWebhookConfiguration
+    jsonPointers:
+    - /webhooks/0/clientConfig/caBundle