Improve e2e smoke test with real git server and push controller exercise

Replace the stub smoke test (which only verified CRD creation) with a
full end-to-end test that:

- Deploys Gitea as an in-cluster git server (emptyDir, auto-install)
- Initializes a test repository with an admin user and initial commit
- Creates GitRepository, GitBranch, and GitPushTransaction CRDs
- Verifies the push controller clones, pushes main to a new branch,
  and transitions the transaction to Succeeded
- Verifies the controller updates the GitBranch CR's headCommit
- Verifies the new branch actually exists on the git server

Also fixes a bug in the push controller's resolveAuth: Secret data
values are base64-encoded when accessed via the dynamic client, but
were being used directly without decoding, causing authentication
failures.

https://claude.ai/code/session_01QfFzqKQUsxxBsiZUhuJ3pG

pkg/reconciler/push/push.go

@@ -2,6 +2,7 @@ package push
 
 import (
 	"context"
+	"encoding/base64"
 	"fmt"
 
 	"github.com/go-git/go-git/v5"
@@ -160,9 +161,21 @@ func (r *Reconciler) resolveAuth(ctx context.Context, namespace string, repo *gi
 		return nil, fmt.Errorf("reading secret data: found=%v err=%v", found, err)
 	}
 
+	// Secret data values are base64-encoded in the API response when
+	// accessed via the dynamic client (unlike the typed client which
+	// decodes automatically into []byte fields).
+	username, err := base64.StdEncoding.DecodeString(data["username"])
+	if err != nil {
+		return nil, fmt.Errorf("decoding username: %w", err)
+	}
+	password, err := base64.StdEncoding.DecodeString(data["password"])
+	if err != nil {
+		return nil, fmt.Errorf("decoding password: %w", err)
+	}
+
 	return &http.BasicAuth{
-		Username: data["username"],
-		Password: data["password"],
+		Username: string(username),
+		Password: string(password),
 	}, nil
 }