k8s/ci-cd: add forgejo gitops and argocd deployment

- Forgejo git forge + OCI registry
- Argo CD pull-based GitOps
- Private CA TLS (self-signed 10-year cert)
- Machine credentials scoped to repositories

k8s/talos-ci-cd/charts/forgejo-runner/templates/pvc.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-reg
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: {{ .Values.persistence.reg.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.reg.size }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: runner-dind
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: {{ .Values.persistence.dind.storageClass }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.dind.size }}