Complete DISCTL-WP-0002-T01: Forgejo off-Gitea mirror

Create private coulomb/disaster-control on forgejo.coulomb.social,
add mirror sync docs and tools/sync-mirror.sh, update registers and
README. Mark T01 done.

docs/mirror-sync.md

@@ -0,0 +1,52 @@
+# Off-Gitea mirror sync
+
+`disaster-control` is mirrored to **Forgejo on railiance01** — infrastructure
+independent of CoulombCore/Gitea (R10 / `DISCTL-WP-0002-T01`).
+
+| Role | Remote | URL |
+| --- | --- | --- |
+| **Primary** | `origin` | `gitea-remote:coulomb/disaster-control.git` |
+| **Mirror** | `mirror` | `forgejo-remote:coulomb/disaster-control.git` |
+
+Web: https://forgejo.coulomb.social/coulomb/disaster-control (private)
+
+## One-time setup (per clone)
+
+```bash
+git remote add mirror forgejo-remote:coulomb/disaster-control.git
+```
+
+## Refresh mirror
+
+After pushing to Gitea (`origin`):
+
+```bash
+./tools/sync-mirror.sh
+# or manually:
+git push mirror main --tags
+```
+
+Mirror all branches (if needed):
+
+```bash
+git push mirror --all --tags
+```
+
+## When to sync
+
+- After every commit pushed to `origin` that should survive Gitea loss
+- After workplan or policy changes (registers, `BackupPolicy.md`, evidence)
+- Before infrastructure migration work (`bin/railiance preflight` on dev workstation)
+
+## Recovery
+
+If Gitea is unavailable:
+
+```bash
+git clone forgejo-remote:coulomb/disaster-control.git
+# or HTTPS with token:
+git clone https://forgejo.coulomb.social/coulomb/disaster-control.git
+```
+
+Forgejo is the **mirror**, not the canonical workflow remote — continue using
+Gitea as `origin` until org cutover decisions say otherwise.