feat(infra): Gitea push webhook -> Argo Events cockpit auto-deploy (Phase 2B Task 6)

- gitea-push eventsource (:12000/push) + gitea-deploy sensor (filter ref main/master ->
  submit fxhnt-cockpit, commit-sha from body.after). Pods NOT part-of:foxhunt (stay
  default-allow, matching working workflow-trigger pattern).
- gitea netpol: egress 12000 namespace-wide (eventsource not part-of -> can't target by label)
- gitea values: webhook.ALLOWED_HOST_LIST=private (Gitea blocked delivery to in-cluster 10.32.x)

Verified: push to fxhnt master auto-fires a cockpit build+deploy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

infra/k8s/argo/events/gitea-deploy-sensor.yaml

@@ -0,0 +1,56 @@
+# On push to fxhnt main/master in Gitea, submit the fxhnt-cockpit build+deploy workflow (Phase 2B).
+# Gitea push payload: { "ref": "refs/heads/main", "after": "<new-sha>", ... }
+apiVersion: argoproj.io/v1alpha1
+kind: Sensor
+metadata:
+  name: gitea-deploy
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: gitea-deploy
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  template:
+    # pod intentionally NOT part-of:foxhunt (avoids default-deny-all; matches working sensors)
+    serviceAccountName: argo-workflow
+    nodeSelector:
+      k8s.scaleway.com/pool-name: platform
+  dependencies:
+    - name: gitea-push-dep
+      eventSourceName: gitea-push
+      eventName: push
+      filters:
+        data:
+          - path: body.ref
+            type: string
+            value:
+              - "refs/heads/main"
+              - "refs/heads/master"
+  triggers:
+    - template:
+        name: deploy-cockpit
+        conditions: gitea-push-dep
+        argoWorkflow:
+          operation: submit
+          source:
+            resource:
+              apiVersion: argoproj.io/v1alpha1
+              kind: Workflow
+              metadata:
+                generateName: fxhnt-cockpit-
+                namespace: foxhunt
+              spec:
+                serviceAccountName: argo-workflow
+                podGC:
+                  strategy: OnPodCompletion
+                ttlStrategy:
+                  secondsAfterCompletion: 3600
+                workflowTemplateRef:
+                  name: fxhnt-cockpit
+                arguments:
+                  parameters:
+                    - name: commit-sha
+          parameters:
+            - src:
+                dependencyName: gitea-push-dep
+                dataKey: body.after
+              dest: spec.arguments.parameters.0.value

infra/k8s/argo/events/gitea-push-eventsource.yaml

@@ -0,0 +1,28 @@
+# Gitea push webhook → Argo Events. Replaces the old gitlab-push eventsource (Phase 2B).
+# Gitea posts to gitea-push-eventsource-svc:12000/push on push to the fxhnt repo.
+apiVersion: argoproj.io/v1alpha1
+kind: EventSource
+metadata:
+  name: gitea-push
+  namespace: foxhunt
+  labels:
+    app.kubernetes.io/name: gitea-push
+    app.kubernetes.io/part-of: foxhunt
+spec:
+  template:
+    # NOTE: pod is intentionally NOT part-of:foxhunt — that label triggers default-deny-all. The working
+    # workflow-trigger/gitlab-push eventsource pods have no part-of, so they stay default-allow.
+    metadata:
+      labels:
+        app.kubernetes.io/name: gitea-push
+    nodeSelector:
+      k8s.scaleway.com/pool-name: platform
+  service:
+    ports:
+      - port: 12000
+        targetPort: 12000
+  webhook:
+    push:
+      port: "12000"
+      endpoint: /push
+      method: POST

infra/k8s/gitea/networkpolicy.yaml

@@ -43,13 +43,10 @@ spec:
     - ports:
         - { port: 53, protocol: UDP }
         - { port: 53, protocol: TCP }
-    # Argo Events webhook target (gitea push hook → eventsource :12000, in-cluster)
+    # Argo Events webhook target (gitea push hook → gitea-push eventsource :12000). The eventsource pod is
+    # not part-of:foxhunt (stays default-allow), so allow egress to any in-namespace pod on 12000.
     - to:
-        - podSelector:
-            matchExpressions:
-              - key: app.kubernetes.io/part-of
-                operator: In
-                values: ["foxhunt", "argo-workflows"]
+        - podSelector: {}
       ports:
         - { port: 12000, protocol: TCP }
     # general HTTPS (avatars, external clones) — external only, exclude cluster CIDRs

infra/k8s/gitea/values.yaml

@@ -56,6 +56,10 @@ gitea:
       USER: gitea
     service:
       DISABLE_REGISTRATION: "true"
+    webhook:
+      # allow delivery to in-cluster targets (Argo Events eventsource on the 10.32.x service CIDR);
+      # default blocks private hosts. Argo auto-deploy webhook needs this.
+      ALLOWED_HOST_LIST: "private"
     # No redis/memcached — use embedded adapters
     cache:
       ADAPTER: memory