feat(gitea): take ownership of Gitea Helm values (T06)

Receive gitea-values.sops.yaml from railiance-cluster — S5 now
owns the Gitea deployment lifecycle per ADR-003 boundary rules.

Add gitea-deploy and gitea-status Makefile targets. Update
SCOPE.md to reflect boundary violation resolved.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SCOPE.md

@@ -53,10 +53,10 @@ Railiance is structured as five independent repos, one per OAS (Open Application
 
 ## Current State
 
-- Status: experimental (placeholder; no active work)
-- Implementation: empty (workplans/ has only .gitkeep; no Helm charts yet)
-- Stability: n/a
-- Usage: will be used after railiance-platform (S3) is operational
+- Status: active (Gitea Helm values now owned by S5; boundary violation resolved)
+- Implementation: Gitea is deployed and operational. Helm values (`helm/gitea-values.sops.yaml`) are now managed from this repo (S5) — moved from railiance-cluster in RAIL-HO-WP-0004-T06. Gitea uses an external cnpg database (`gitea-db` in the `databases` namespace) and standalone Valkey.
+- Stability: Gitea stable; S5 layer now owns the Gitea deployment lifecycle
+- Usage: Gitea serves as the git hosting platform for all Railiance and Custodian repos
 
 ---
 
@@ -99,3 +99,4 @@ keywords: [gitea, coulomb, webapp, helm, application, deployment, workload]
 - Start with: `CLAUDE.md` (session protocol, boundary rules)
 - Key files / directories: `workplans/` (currently empty), `Makefile`
 - Pre-conditions: all four lower layers (S1–S4) must be converged and verified
+- Key files: `helm/gitea-values.sops.yaml` (Gitea Helm values, SOPS-encrypted), `releases/gitea/values.yaml` (legacy plain values — superseded)