feat: operational tooling — signing, versioning, changelog, roadmap (SPEC-001)

Establish GuruConnect's release engineering and project tracking (SPEC-001):
- docs/ scaffold: FEATURE_ROADMAP, ARCHITECTURE_DECISIONS (ADR-001 standalone+contract,
  ADR-002 Gitea Actions + Azure Trusted Signing), docs/specs/SPEC-001, CHANGELOG.
- .gitea/workflows/release.yml: conventional-commit auto-versioning, git-cliff changelog,
  Windows agent build, Azure Trusted Signing via jsign (reusing the shared ACG cert profile),
  Gitea release via REST API. build-and-test.yml is the PR/push gate; deploy.yml de-duplicated.
- server: GET /api/changelog/:component/:version (latest + by-version), path-traversal hardened.
- cliff.toml; server/.env.example documents CHANGELOG_DIR.

Reviewed (Code Review Agent): axum route-conflict blocker fixed; CHANGELOG ordering, toolchain
target, breaking-change parsing, empty-changelog fallback addressed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -1,5 +1,12 @@
 name: Deploy to Production
 
+# Server deployment only. Release creation and agent signing live in release.yml (SPEC-001) —
+# this workflow no longer creates releases, so there is exactly one release producer in the repo.
+#
+# Triggers on a pushed vX.Y.Z tag (which release.yml creates) or manual dispatch. The previous
+# GitHub-only `actions/create-release@v1` + GITHUB_TOKEN job has been removed; it does not work on
+# Gitea. Gitea releases are produced by release.yml via the Gitea REST API.
+
 on:
   push:
     tags:
@@ -30,6 +37,11 @@ jobs:
           toolchain: stable
           target: x86_64-unknown-linux-gnu
 
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libssl-dev protobuf-compiler
+
       - name: Build server
         run: |
           cd server
@@ -37,12 +49,17 @@ jobs:
 
       - name: Create deployment package
         run: |
+          set -euo pipefail
           mkdir -p deploy
           cp server/target/x86_64-unknown-linux-gnu/release/guruconnect-server deploy/
           cp -r server/static deploy/
           cp -r server/migrations deploy/
+          # Ship generated changelogs so the server's /api/changelog endpoint can serve them
+          # (CHANGELOG_DIR points at this directory in production).
+          if [ -d changelogs ]; then cp -r changelogs deploy/; fi
           cp server/.env.example deploy/.env.example
           tar -czf guruconnect-server-${{ github.ref_name }}.tar.gz -C deploy .
+          echo "[OK] Packaged guruconnect-server-${{ github.ref_name }}.tar.gz"
 
       - name: Upload deployment package
         uses: actions/upload-artifact@v3
@@ -54,35 +71,8 @@ jobs:
       - name: Deploy to server (production)
         if: github.event.inputs.environment == 'production' || startsWith(github.ref, 'refs/tags/')
         run: |
-          echo "Deployment command would run here"
-          echo "SSH to 172.16.3.30 and deploy"
+          echo "[INFO] Deployment command would run here"
+          echo "[INFO] SSH to 172.16.3.30 and deploy"
           # Actual deployment would use SSH keys and run:
           # scp guruconnect-server-*.tar.gz guru@172.16.3.30:/tmp/
           # ssh guru@172.16.3.30 'bash /home/guru/guru-connect/scripts/deploy.sh'
-
-  create-release:
-    name: Create GitHub Release
-    runs-on: ubuntu-latest
-    needs: deploy-server
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Download artifacts
-        uses: actions/download-artifact@v3
-
-      - name: Create Release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref_name }}
-          release_name: Release ${{ github.ref_name }}
-          draft: false
-          prerelease: false
-
-      - name: Upload Release Assets
-        run: |
-          echo "Upload server and agent binaries to release"
-          # Would attach artifacts to the release here