fix: vendor Tekton release.yaml for proper ArgoCD management

ROOT CAUSE:
- tektoncd/pipeline config/ dir uses ko:// image refs (build-time placeholders)
- ArgoCD synced the raw dev manifests → InvalidImageName on all pods
- tektoncd/operator requires its own CRDs and controller (too heavy)
- Tekton has no official Helm chart

FIX:
- Vendor the pre-built release.yaml (v0.68.0) into k8s/infra/tekton/
- Point ArgoCD Application at our own repo (forgejo)
- Release contains real container images (ghcr.io/tektoncd/pipeline/*)
- Remove external tektoncd repo from AppProject (not needed)

TO UPGRADE TEKTON:
  1. Download new release from github.com/tektoncd/pipeline/releases
  2. Replace k8s/infra/tekton/release.yaml
  3. Commit — ArgoCD syncs automatically

k8s/infra/tekton/kustomization.yaml

@@ -1,40 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-metadata:
-  name: tekton-pipelines
-
-# Tekton release includes CRDs, RBAC, controllers, webhook
-# We use a remote base to stay on the latest stable release
-bases:
-- https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml?ref=main
-
-# Add our local namespace override
-resources:
-- namespace.yaml
-
-# Common labels for all resources
-commonLabels:
-  app: tekton
-  component: pipelines
-  managed-by: argocd
-
-# Don't transform namespace - let the release define its own
-# namespace: tekton-pipelines
-
-patches:
-  # Ensure webhook is properly configured for validation
-  - target:
-      kind: ValidatingWebhookConfiguration
-      name: validation.webhook.pipeline.tekton.dev
-    patch: |-
-      - op: replace
-        path: /webhooks/0/failurePolicy
-        value: Fail
-  # Ensure mutation webhook is properly configured
-  - target:
-      kind: MutatingWebhookConfiguration
-      name: webhook.pipeline.tekton.dev
-    patch: |-
-      - op: replace
-        path: /webhooks/0/failurePolicy
-        value: Fail

k8s/infra/tekton/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tekton-pipelines
-  labels:
-    name: tekton-pipelines
-    managed-by: argocd