feat: Tekton-based integration testing (proper K8s CI/CD)

Replace ad-hoc K8s Job with proper Tekton TaskRun:

k8s/tekton/integration-test-task.yaml:
  - Tekton Task for integration testing
  - Two stages: migrate + test
  - Runs existing Rust integration tests:
    * it_phase3_phase4 (ingest + persistence)
    * it_unified_query_4_6 (query endpoint)
    * it_temporal_filtering_4_2_fixed (temporal)
    * mem_ingest (extraction pipeline)
    * mem_cli::query (query handler)
  - Reports results to /tekton/results/summary
  - Resource limits: 1Gi mem, 500m CPU

.gitea/workflows/build.yaml:
  - Integrated Tekton trigger after image push
  - Create TaskRun with image SHA
  - Wait for completion (5m timeout)
  - Gate image promotion on test passing
  - Only promote to :latest if tests pass

Pattern (from homelab-frontend):
  1. Build image → push with SHA
  2. Trigger Tekton TaskRun
  3. Wait for result
  4. Gate promotion
  5. Promote to :latest only if tests pass

Benefits:
  ✓ Proper K8s CI/CD framework
  ✓ Reusable Task
  ✓ Better logging/results
  ✓ Proper resource mgmt
  ✓ Matches homelab pattern

Requires:
  - Tekton Pipelines installed in cluster
  - KUBECONFIG_B64 secret in Forgejo

.gitea/workflows/build.yaml

@@ -71,7 +71,100 @@ jobs:
           docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
           echo "Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
 
-      - name: Prune unused images and cleanup
+      - name: Install kubectl
+        run: |
+          apt-get update
+          apt-get install -y kubectl
+
+      - name: Setup kubeconfig for Tekton
+        run: |
+          mkdir -p ~/.kube
+          echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
+          chmod 600 ~/.kube/config
+          kubectl cluster-info 2>&1 | head -3
+          echo "✓ kubeconfig ready"
+        env:
+          KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
+
+      - name: Trigger Tekton TaskRun (integration tests)
+        id: tekton
+        run: |
+          SHA="${{ steps.sha.outputs.short_sha }}"
+          RUN_NAME="integration-test-${SHA}"
+          NAMESPACE="poimen"
+          IMAGE="${REGISTRY}/riotpiao-poimen/poimen-memory:${SHA}"
+
+          echo "Triggering Tekton TaskRun: ${RUN_NAME}"
+          echo "Image: ${IMAGE}"
+          echo ""
+
+          # Create TaskRun
+          cat <<YAML | kubectl create -f -
+          apiVersion: tekton.dev/v1
+          kind: TaskRun
+          metadata:
+            name: ${RUN_NAME}
+            namespace: ${NAMESPACE}
+            labels:
+              commit-sha: "${SHA}"
+          spec:
+            taskRef:
+              name: poimen-integration-test
+            params:
+            - name: image
+              value: "${IMAGE}"
+          YAML
+
+          echo "✓ TaskRun created"
+          echo ""
+          echo "Waiting for completion (timeout 5m)..."
+
+          # Wait for TaskRun to complete
+          if kubectl wait taskrun/${RUN_NAME} -n ${NAMESPACE} \
+               --for=condition=Succeeded --timeout=5m 2>/dev/null; then
+            echo "result=pass" >> $GITHUB_OUTPUT
+            echo "✓ Tests passed"
+          else
+            echo "result=fail" >> $GITHUB_OUTPUT
+            echo "✗ Tests failed or timed out"
+          fi
+
+          # Print test summary
+          echo ""
+          echo "=== TaskRun Status ==="
+          REASON=$(kubectl get taskrun ${RUN_NAME} -n ${NAMESPACE} \
+            -o jsonpath='{.status.conditions[0].reason}')
+          SUMMARY=$(kubectl get taskrun ${RUN_NAME} -n ${NAMESPACE} \
+            -o jsonpath='{.status.results[?(@.name=="summary")].value}')
+          echo "Status: ${REASON}"
+          echo "Summary: ${SUMMARY}"
+
+          # Print logs
+          echo ""
+          echo "=== Test Logs ==="
+          POD=$(kubectl get pod -n ${NAMESPACE} \
+            -l tekton.dev/taskRun=${RUN_NAME} -o name | head -1)
+          kubectl logs -n ${NAMESPACE} "${POD}" -c step-test 2>/dev/null | tail -200 || true
+
+      - name: Gate on test result
+        if: steps.tekton.outputs.result != 'pass'
+        run: |
+          echo "✗ Integration tests FAILED"
+          echo "Image NOT promoted to :latest"
+          exit 1
+
+      - name: Promote image to latest
+        run: |
+          docker login -u "${REGISTRY_USER}" -p "${REGISTRY_TOKEN}" "${REGISTRY}"
+          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
+          docker push "${IMAGE}:latest"
+          echo "✓ Promoted to :latest"
+        env:
+          REGISTRY_USER: ${{ secrets.FORGEJO_REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.FORGEJO_REGISTRY_TOKEN }}
+
+      - name: Cleanup
+        if: always()
         run: |
           docker image prune -a --force 2>&1 | tail -3 || true
           cargo clean || true