feat: add upgrade-requester, fix Gitea auth to use GITEA_USERNAME env var

- Add request_upgrades.py and trigger-upgrade.sh
- Add upgrade-cronjob.yaml and manual-trigger.yaml (WorkflowTemplate)
- Fix git auth: use GITEA_USERNAME env var instead of hardcoded x-token
  (Gitea requires username:token format, not x-token:token)

trigger-upgrade.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SSH_KEY="$(dirname "$0")/../../util/ssh-keys/id_rsa"
+CONTROL_PLANE="ubuntu@192.168.86.200"
+NAMESPACE="k8s-version-tracker"
+JOB_NAME="upgrade-manual-$(date +%Y%m%d-%H%M)"
+
+echo "Triggering upgrade-requester job: $JOB_NAME"
+ssh -i "$SSH_KEY" "$CONTROL_PLANE" \
+  "kubectl create job $JOB_NAME --from=cronjob/upgrade-requester -n $NAMESPACE"
+
+echo ""
+echo "Job created. Follow logs with:"
+echo "  ssh -i util/ssh-keys/id_rsa ubuntu@192.168.86.200 \\"
+echo "    \"kubectl logs -n $NAMESPACE -l job-name=$JOB_NAME -f\""