feat: add Tekton Pipelines for CI/CD orchestration

Install Tekton Pipelines via ArgoCD for Kubernetes-native CI/CD:

COMPONENTS:
- Tekton Pipelines: CNCF-standard test orchestration
- Task/Pipeline CRDs: Reusable workflow definitions
- PipelineRun: Ephemeral execution instances
- ArgoCD Application: GitOps-managed installation

INTEGRATION:
- homelab-frontend CI triggers PipelineRun via Kubernetes API
- Tests run in cluster against actual services
- Results flow back to CI for pass/fail decisions
- Image promotion only on test success

FILES:
- k8s/infra/tekton/: Tekton infrastructure setup
  - namespace.yaml: tekton-pipelines namespace
  - kustomization.yaml: Release manifest reference
- k8s/argocd/apps/06-ci-cd.yaml: ArgoCD Application
- k8s/argocd/projects/homelab-project.yaml: Added Tekton repos

WAVE ORDERING:
Wave 06 (CI/CD) is deployed after:
  - Wave 05 (Networking)
  - Wave 04 (Core components)
But before Wave 40+ (Applications)

BENEFITS:
✓ Kubernetes-native (no external CI runners)
✓ GitOps-managed (everything in git via ArgoCD)
✓ CNCF-standard (industry-proven Tekton project)
✓ Pre-merge testing (tests must pass before deploy)
✓ Observable (logs, status, results tracking)
✓ Secure (non-root, resource limits, RBAC)

k8s/infra/tekton/kustomization.yaml

@@ -0,0 +1,40 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+metadata:
+  name: tekton-pipelines
+
+# Tekton release includes CRDs, RBAC, controllers, webhook
+# We use a remote base to stay on the latest stable release
+bases:
+- https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml?ref=main
+
+# Add our local namespace override
+resources:
+- namespace.yaml
+
+# Common labels for all resources
+commonLabels:
+  app: tekton
+  component: pipelines
+  managed-by: argocd
+
+# Don't transform namespace - let the release define its own
+# namespace: tekton-pipelines
+
+patches:
+  # Ensure webhook is properly configured for validation
+  - target:
+      kind: ValidatingWebhookConfiguration
+      name: validation.webhook.pipeline.tekton.dev
+    patch: |-
+      - op: replace
+        path: /webhooks/0/failurePolicy
+        value: Fail
+  # Ensure mutation webhook is properly configured
+  - target:
+      kind: MutatingWebhookConfiguration
+      name: webhook.pipeline.tekton.dev
+    patch: |-
+      - op: replace
+        path: /webhooks/0/failurePolicy
+        value: Fail

k8s/infra/tekton/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tekton-pipelines
+  labels:
+    name: tekton-pipelines
+    managed-by: argocd