Add Dockerfile + Gitea Actions workflow for mcp-grafana container

- Dockerfile: fetches pinned upstream release binary (static Go) from
  grafana/mcp-grafana GitHub releases, sha256-verified against the
  release's own checksums file, runs from scratch.
- Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch;
  resolves newest release, skips if tag published, pushes
  gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest.
- REGISTRY_TOKEN repo Actions secret already provisioned.

Dockerfile

@@ -0,0 +1,62 @@
+# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
+# streamable-HTTP container for cluster0.
+#
+# Built by Gitea Actions (.gitea/workflows/build.yaml):
+#   - on push to main
+#   - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
+#     the tag is already published) — lands ~7h BEFORE the cluster0
+#     image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
+#     deployment tag like any other app.
+#   - on manual workflow_dispatch with an explicit version
+#
+# The upstream release is a SINGLE static Go binary, fetched from the pinned
+# GitHub release and verified against the release's own sha256 checksums
+# file. No vendored code. Published as
+# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
+#
+# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
+# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
+# this image — the token comes from the server's own Kubernetes secret
+# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
+
+ARG MCP_GRAFANA_VERSION=v1.1.0
+
+FROM docker.io/library/alpine:3.22 AS fetch
+
+ARG MCP_GRAFANA_VERSION
+ARG TARGETARCH
+
+# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
+# upstream release. ca-certificates for HTTPS to github.com.
+RUN apk add --no-cache curl tar coreutils ca-certificates
+
+WORKDIR /tmp
+
+# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
+# verify the tarball's sha256 against the checksums file. Fails the build on
+# any mismatch (checksums.txt entries: "<sha256>  mcp-grafana_Linux_<arch>.tar.gz").
+RUN set -eux; \
+    SHORT="${MCP_GRAFANA_VERSION#v}"; \
+    case "$TARGETARCH" in \
+        amd64) ASSET="Linux_x86_64" ;; \
+        arm64) ASSET="Linux_arm64" ;; \
+        *) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
+    curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \
+    grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
+    tar -xzf mcp.tar.gz mcp-grafana; \
+    chmod +x mcp-grafana
+
+# The binary is fully static (no INTERP segment) — scratch is sufficient.
+FROM scratch
+
+COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
+
+EXPOSE 3000
+
+# streamable-http on all interfaces, port 3000 (the service port).
+# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
+# protection: only the in-cluster service hostname is trusted).
+# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
+ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]