tools: disable Gitea package push on coulombcore (read-only mirror)

IngressRoute allows GET/HEAD/OPTIONS on /v2 and /api/packages; removes
those paths from catch-all Ingress; sets zero package upload limits in
Gitea app.ini. Complements archived git repos (RAIL-HO-WP-0005).

tools/gitea-package-readonly-ingressroute.yaml

@@ -0,0 +1,24 @@
+# Read-only package registry paths on coulombcore Gitea.
+# Allows GET/HEAD/OPTIONS (pull/index); blocks POST/PUT/PATCH/DELETE at the edge.
+# Apply together with tools/gitea-disable-package-push.sh (patches main Ingress).
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-packages-readonly
+  namespace: default
+  labels:
+    app.kubernetes.io/name: gitea
+    app.kubernetes.io/instance: gitea
+    app.kubernetes.io/part-of: railiance-forge
+    railiance/component: gitea-package-readonly
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`gitea.coulomb.social`) && (PathPrefix(`/v2`) || PathPrefix(`/api/packages`)) && (Method(`GET`) || Method(`HEAD`) || Method(`OPTIONS`))
+      kind: Rule
+      services:
+        - name: gitea-http
+          port: 3000
+  tls:
+    secretName: gitea-tls