Add CI, repo CLAUDE.md, and finish Stage 0

- .gitea/workflows/ci.yaml: fmt/lint/test, same no-actions/checkout-and-manual-clone
  shape as terdut-server's ci.yaml, and the same reasoning for why (Node/ES2022
  incompatibility on the runner image). No chart/security jobs yet -- nothing for
  either to check until Stage 6 / real controller code exists.
- CLAUDE.md: Checks + Release sections, matching the sibling repos' convention from
  the workspace-level CLAUDE.md ("each repo has its own CLAUDE.md... read it before
  working in that repo"). Release is explicitly marked not-wired-yet rather than
  copying terdut-server's, since there's no chart to release against until Stage 6.
- ROADMAP.md: moved the .release.conf bullet out of Stage 0 (it names a HELM_CHART
  this repo doesn't have yet) -- it was already duplicated into Stage 6, which is
  where it actually belongs.

Stage 0 done: `make fmt lint test` verified green locally. Real open question the CI
workflow's comments flag rather than assume past: whether storage.googleapis.com
(envtest's binary source) is reachable from this Gitea runner's container network the
way proxy.golang.org is -- terdut-server's own ci.yaml notes get.helm.sh/github.com are
not. Only running the workflow for real will confirm; the comment names the fallback
(move the job out of `container:`, like terdut-server's chart job) if it isn't.

CLAUDE.md

@@ -0,0 +1,25 @@
+# terdut-operator
+
+Kubebuilder/controller-runtime operator for terdut-server. See `DESIGN.md` for the
+settled design (CRD catalog, reconciliation semantics, bootstrap/auth, RBAC) and
+`ROADMAP.md` for the staged build plan this repo is following. `README.md` stays the
+short pitch.
+
+## Checks
+
+`make fmt lint test` is the CI gate (`.gitea/workflows/ci.yaml` calls these targets
+rather than restating them, same convention as terdut-server). `test` chains through
+the Kubebuilder-scaffolded `manifests`/`generate` (`controller-gen`) and `setup-envtest`
+targets automatically — everything needed lands in `bin/` (gitignored) on first run, no
+separate tool install required beyond Go itself and network access to
+`proxy.golang.org`/`storage.googleapis.com`.
+
+`make test-e2e` stands up a real `kind` cluster (`kind`/`docker` must be installed) and
+is not part of the CI gate yet — it has no service-image to test against until later
+ROADMAP stages produce one.
+
+## Release
+
+Not wired yet. `.release.conf` and the release-vars Makefile target land in ROADMAP.md's
+Stage 6, once there's an actual Helm chart to release — see that file before assuming
+the `release` skill's terdut-server/terdut-tui conventions already apply here.