Add two new guidance documents alongside generic.md:
- deployment-gitea-actions.md: CI-driven deployment via a Gitea Actions
workflow as an alternative to deploy.sh + manifest.yml (§7), with the
workflow as the source of infra truth and a scoped gitea_ci runner user.
- internal-tls.md: provisioning and renewing per-service internal TLS
certs (<service>.internal) for mesh-only nginx vhosts, extending the
PKI conventions in §11.
Cross-reference both from generic.md and list them in readme.md. Also
add a "never suppress errors" rule to the deploy-script conventions.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
