Add TLS certificates and private keys for telemetry components

- Added CA certificate (ca.crt) and private key (ca.key) for secure communication.
- Added client certificate (client.crt) and private key (client.key) for client authentication.
- Added collector certificate (collector.crt) and private key (collector.key) for collector authentication.

.gitea/workflows/build-test-deploy.yml

@@ -81,12 +81,60 @@ jobs:
       - name: Validate telemetry storage configuration
         run: python3 ops/devops/telemetry/validate_storage_stack.py
 
+      - name: Telemetry tenant isolation smoke
+        env:
+          COMPOSE_DIR: ${GITHUB_WORKSPACE}/deploy/compose
+        run: |
+          set -euo pipefail
+          ./ops/devops/telemetry/generate_dev_tls.sh
+          COMPOSE_DIR="${COMPOSE_DIR:-${GITHUB_WORKSPACE}/deploy/compose}"
+          cleanup() {
+            set +e
+            (cd "$COMPOSE_DIR" && docker compose -f docker-compose.telemetry.yaml down -v --remove-orphans >/dev/null 2>&1)
+            (cd "$COMPOSE_DIR" && docker compose -f docker-compose.telemetry-storage.yaml down -v --remove-orphans >/dev/null 2>&1)
+          }
+          trap cleanup EXIT
+          (cd "$COMPOSE_DIR" && docker compose -f docker-compose.telemetry-storage.yaml up -d)
+          (cd "$COMPOSE_DIR" && docker compose -f docker-compose.telemetry.yaml up -d)
+          sleep 5
+          python3 ops/devops/telemetry/smoke_otel_collector.py --host localhost
+          python3 ops/devops/telemetry/tenant_isolation_smoke.py \
+            --collector https://localhost:4318/v1 \
+            --tempo https://localhost:3200 \
+            --loki https://localhost:3100
+
       - name: Setup .NET ${{ env.DOTNET_VERSION }}
         uses: actions/setup-dotnet@v4
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
           include-prerelease: true
 
+      - name: Build CLI multi-runtime binaries
+        run: |
+          set -euo pipefail
+          export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
+          RUNTIMES=(linux-x64 linux-arm64 osx-x64 osx-arm64 win-x64)
+          rm -rf out/cli-ci
+          for runtime in "${RUNTIMES[@]}"; do
+            dotnet publish src/Cli/StellaOps.Cli/StellaOps.Cli.csproj \
+              --configuration $BUILD_CONFIGURATION \
+              --runtime "$runtime" \
+              --self-contained true \
+              /p:PublishSingleFile=true \
+              /p:IncludeNativeLibrariesForSelfExtract=true \
+              /p:EnableCompressionInSingleFile=true \
+              /p:InvariantGlobalization=true \
+              --output "out/cli-ci/${runtime}"
+          done
+
+      - name: Run CLI unit tests
+        run: |
+          mkdir -p "$TEST_RESULTS_DIR"
+          dotnet test src/Cli/StellaOps.Cli.Tests/StellaOps.Cli.Tests.csproj \
+            --configuration $BUILD_CONFIGURATION \
+            --logger "trx;LogFileName=stellaops-cli-tests.trx" \
+            --results-directory "$TEST_RESULTS_DIR"
+
       - name: Restore Concelier solution
         run: dotnet restore src/Concelier/StellaOps.Concelier.sln