chore: open-source readiness — PR CI, drop the internal pipeline, public images, English docs

[imneov]

What type of PR is this?

• bug fix
• documentation
• install / chart
• CI / tooling

What this PR does and why

Brings autoconfig in line with the organization's open-source baseline (same as console and hang-watcher). One concern per commit:

1. chore: stop tracking the .DS_Store committed at the root; ignore it.
2. chore(ci): delete .gitlab-ci.yml. It only built images and the chart for the internal registry and named that registry, its base-image cache and its runner. The comments in release.yml and the three Dockerfiles that pointed at it now document the build args with placeholders.
3. chore: the Makefile, config/manager and the chart default to the images release.yml publishes (4pdosc/autoconfig*) instead of the internal registry. make docker-build no longer passes internal base-image / China Go-proxy overrides by default (BUILD_ARGS still accepts them). Chart home points at GitHub. The kustomize tag moves from 0.3.41 (no public image) to 0.4.0.
4. chore: samples and e2e scripts use public images: 4pdosc/autoconfig* (default tag 0.4.0, the first release under routing.modelsphere.dev), 4pdosc/llm-openresty:0.1.20, 4pdosc/cache_aware_router:0.6.5, python:3.12-alpine, upstream lmsysorg/sglang:v0.5.10.post1 (instead of an internally patched build of the same version). llm-monitor has no public image, so MON_IMG must now be set and the scripts say so. A hard-coded node of an internal cluster in the backend samples is now a commented nodeName placeholder.
5. docs: four comments named an internal routing product as the example of a proxy in front of openresty; they now say "upstream proxy".
6. docs(deploy): DEPLOY.md installed everything from the internal ChartMuseum; it now uses https://modelsphere.github.io/helm-charts (modelsphere/autoconfig, modelsphere/openresty, modelsphere/cart). monitor has no public chart: the guide says so and how to skip it (spec.monitor is optional).
7. fix(docker): release.yml builds linux/amd64 and linux/arm64, but the Dockerfiles fixed GOARCH=amd64, so the arm64 images contain an amd64 binary. GOOS/GOARCH now come from BuildKit's TARGETOS/TARGETARCH (defaulting to linux/amd64 for the legacy builder, so the amd64 image is unchanged).
8. ci: ci.yml on every pull request and push to main — gofmt, go vet, make test (regenerates CRD/RBAC/deepcopy, vets, runs the unit tests; there is no envtest) plus a check that generation leaves no diff, helm lint --strict + helm template of deploy/helm/autoconfig, a docker build of the main Dockerfile, and the license/credential gate. Actions pinned to SHAs, read-only token.
9. ci: Dependabot for Go modules (k8s grouped) and Actions. No docker entry: the FROM lines are build args, which Dependabot cannot follow.
10. docs: NOTICE — the direct Go dependencies in the images with licenses read from their LICENSE files, and the base images.
11. docs: README.md is now English; the Chinese original is README.zh-CN.md. Two stale statements corrected in both (how images are released; CI now reruns generation).
12. docs: DEPLOY.md is now English; the Chinese is DEPLOY.zh-CN.md.
13. docs(changelog): CHANGELOG.md in Keep a Changelog form: one dated section per tag on the remote (0.3.45, 0.3.46, 0.3.47, 0.4.0), from git log between the tags, plus Unreleased for this PR.
14. docs: a test comment named an internal machine; now "a test cluster".

Not in this PR: code comments, CRD field descriptions, templates and e2e scripts are still largely Chinese (about 1,150 lines in Go, 230 in the generated CRDs, 360 in e2e scripts, 230 in config/chart YAML); translating them is a separate PR. RUN_BOOK.md is removed (last commit): it was the runbook for one internal cluster — its machine, a day's version snapshot, tools outside this repo.

The Helm chart in modelsphere/helm-charts (charts/autoconfig) is a separate copy and is not touched here.

Which issue(s) this PR fixes

None — open-source readiness.

How it was tested

• make test (controller-gen crd/rbac/object, go fmt, go vet, go test ./...): pass — controller, discovery, reload, sink ok; git status clean afterwards (generated files match).
• gofmt -l .: empty.
• helm lint --strict deploy/helm/autoconfig: 1 chart linted, 0 failed; helm template: renders.
• GOOS=linux GOARCH=arm64 go build ./cmd: produces an aarch64 ELF (the Dockerfile fix relies on this).
• bash -n on every e2e script: no syntax errors. The e2e scripts themselves need a cluster and were not run.
• docker build: this machine cannot pull from Docker Hub; the docker job in this PR's CI builds the main Dockerfile.

Checks

• Tests and linters for what changed pass locally (see the repository's README or CONTRIBUTING)
• Docs updated where behaviour, a config key or a chart value moved
• No internal hostnames, IPs, registries or credentials

Release note

The arm64 images now contain an arm64 binary (they shipped an amd64 one). The chart, kustomize manifests and Makefile default to the public 4pdosc/autoconfig images.