ci: add deployment pipeline following bcit-tlu org patterns

[devin-ai-integration]

Summary

Migrates qcon-guide from the legacy bcit-ltc org workflow to the bcit-tlu deployment strategy, producing a fully working CI/CD pipeline, Helm chart, and release automation matching the patterns used by sugar-suite and course-workload-estimator.

Changes

Dockerfile

• Updated OCI labels to point to bcit-tlu org
• Restructured with explicit WORKDIR and clean COPY ordering matching org conventions
• Pinned squidfunk/mkdocs-material to a specific digest for reproducible builds

conf.d/default.conf — rewritten from scratch:

• Removed redundant json_analytics log format and stub_status endpoint
• Standardized probe filtering with map directives (log only failing kube-probes)
• Added gzip_static on / gzip_vary on for precompressed assets
• Added cache headers: immutable for hashed assets, must-revalidate for HTML
• Added security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy
• Added error_page 404 /404.html for branded error pages
• Kept JSON structured logging and all three health endpoints (/healthz, /healthz/startup, /healthz/ready)

Helm chart (charts/):

• Chart.yaml with x-release-please-version annotation
• values.yaml with image, probes, resources, zoneAntiAffinity
• Templates: _helpers.tpl, deployment.yaml, service.yaml, ingress.yaml, serviceaccount.yaml

CI/CD workflows (.github/workflows/):

• ci.yaml — helm-lint + OCI build via bcit-tlu/.github reusable workflow + chart publish on main
• release-please.yaml — automated versioning with stale release-as guard
• helm-publish.yaml — release-time chart OCI publish with Cosign signing
• release-retag.yaml — release image retagging with highest-stable detection
• pr-title-lint.yaml — conventional commit enforcement

Release automation:

• release-please-config.json (simple strategy, no component)
• .release-please-manifest.json seeded at 0.1.0
• VERSION and CHANGELOG.md

Housekeeping:

• Deactivated legacy build-and-push-app.yaml → .inactive
• Added AGENTS.md, shell.nix
• Updated .envrc, docker-compose.yml, README.md
• Removed duplicate docs/assets/randomize.jpg (only .png is referenced)
• Updated .devcontainer name from review to qcon-guide

Review & Testing Checklist for Human

• Verify the Helm chart values in charts/values.yaml match desired resource limits and image repository path (ghcr.io/bcit-tlu/qcon-guide/qcon-guide)
• Confirm CI passes: helm-lint and build-qcon-guide jobs should both succeed on this PR
• After merge, verify release-please opens a release PR and the first image builds correctly
• Register qcon-guide in bcit-tlu/vault config.auto.tfvars apps list and run terraform apply before Flux deployment
• Merge the companion flux-fleet PR to enable Kubernetes deployment: https://github.com/bcit-tlu/flux-fleet/pull/75

Notes

• The mkdocs.yml site_url still references qcon-guide.ltc.bcit.ca — update this once the new ingress domain is confirmed
• A stable overlay for production can be added to flux-fleet later when ready
• Created issue refactor: migrate from MkDocs Material (EOL) to Zensical #2 for migrating from MkDocs Material (EOL) to Zensical

Link to Devin session: https://app.devin.ai/sessions/d5a39e0d582d45718040cf3cd0b64895
Requested by: @kphunter

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring