fix(bp-gitea): set HR install/upgrade timeout=15m for fresh-prov mirror push (#131)

Diagnostic on prov #16 (083f8c9abbcf64d4) found bp-gitea HR looping in
5-minute install attempts on a fresh Sovereign — Helm post-install hook
(gitea init: org seed + Catalyst-Zero blueprint mirror push per
feedback_gitea_mirror_blocks_cutover_push.md) takes >5m on cold control plane.
After each timeout flux-helm-controller uninstalls + reinstalls, so the hook
restarts from scratch and never gets enough wall-clock to complete.

This blocks bp-self-sovereign-cutover (depends on bp-gitea Ready) → cutover
auto-trigger Job never runs → kubeconfig PUT-back to catalyst-api never
happens → phase1-watching wedges forever (35+ min observed on prov #15
and #16). Same root-cause class as Fix #127 (cutover timeout) and Fix #129
(keycloak hook timeout).

Fix:
- HR install/upgrade timeout: 5m (default) → 15m
- disableWait: true preserved (downstream dependsOn checks Ready=True)
- remediation retries=3 preserved

Per CLAUDE.md principle 16: canonical seam is HR-level timeout, same as
the keycloak/cutover wedges. Per principle 4: real fix not workaround —
gitea bootstrap legitimately needs >5m on fresh Sovereign.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clusters/_template/bootstrap-kit/10-gitea.yaml

@@ -63,10 +63,12 @@ spec:
   # checks Ready=True independently. Replaces PR #221 spec.timeout: 15m.
   install:
     disableWait: true
+    timeout: 15m
     remediation:
       retries: 3
   upgrade:
     disableWait: true
+    timeout: 15m
     remediation:
       retries: 3
   values: