Implement Git-as-K8s control plane with Knative controllers

Build a complete Kubernetes control plane for Git operations using Knative's
pkg framework, go-git for in-memory Git operations, and ko for builds.

Architecture:
- 4 CRDs: GitRepository, GitBranch, GitPushTransaction, GitRepoSync
- Push controller: atomic Git push via go-git with CAS (compare-and-swap)
- Sync controller: two-way sync with in-memory merge base calculation
- Resolver controller: automated 3-way merge for conflicted syncs
- In-cluster Gitea server for backing storage
- Full RBAC, ko-based deployments, and code-gen scaffolding

Note: go.sum needs generation via `go mod tidy` in an environment with
full internet access (knative.dev/pkg v0.0.0-20250520014526-44579e9ce5ed).

https://claude.ai/code/session_01QfFzqKQUsxxBsiZUhuJ3pG

config/deployments/push-controller.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: push-controller
+  namespace: git-system
+  labels:
+    app.kubernetes.io/name: git-k8s
+    app.kubernetes.io/component: push-controller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: push-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: git-k8s
+        app.kubernetes.io/component: push-controller
+    spec:
+      serviceAccountName: git-k8s-controller
+      containers:
+        - name: controller
+          # ko will replace this with the actual registry image SHA.
+          image: ko://github.com/imjasonh/git-k8s/cmd/push-controller
+          env:
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: CONFIG_LOGGING_NAME
+              value: config-logging
+            - name: CONFIG_OBSERVABILITY_NAME
+              value: config-observability
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL