Initial scaffold: API service, K8s operator, and CRDs

Forgebot is a K8s operator + API service for dispatching AI agent
jobs from git forge commands. Includes:

- CRDs: AgentPool, AgentTask, ProviderQueue, RepositoryBinding
- API server with webhook handler, task queue, and comment proxy
- Operator controllers for task scheduling and job management
- Gitea provider with webhook parsing and signature verification
- PostgreSQL database with auto-migration
- Woodpecker CI pipelines and multi-stage Dockerfiles

config/crd/bases/forgebot.unkin.net_repositorybindings.yaml

@@ -0,0 +1,94 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.17.3
+  name: repositorybindings.forgebot.unkin.net
+spec:
+  group: forgebot.unkin.net
+  names:
+    kind: RepositoryBinding
+    listKind: RepositoryBindingList
+    plural: repositorybindings
+    singular: repositorybinding
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .spec.repository
+      name: Repo
+      type: string
+    - jsonPath: .spec.agentPoolRef
+      name: Pool
+      type: string
+    - jsonPath: .status.webhookRegistered
+      name: Webhook
+      type: boolean
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              agentPoolRef:
+                type: string
+              allowedCommands:
+                items:
+                  type: string
+                type: array
+              allowedUsers:
+                items:
+                  type: string
+                type: array
+              providerQueueRef:
+                type: string
+              repository:
+                type: string
+              skillMapping:
+                items:
+                  properties:
+                    command:
+                      type: string
+                    skill:
+                      type: string
+                  required:
+                  - command
+                  - skill
+                  type: object
+                type: array
+            required:
+            - agentPoolRef
+            - providerQueueRef
+            - repository
+            type: object
+          status:
+            properties:
+              lastError:
+                type: string
+              webhookRegistered:
+                type: boolean
+            required:
+            - webhookRegistered
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}