Deploy KeyCape canonical subject fix

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663

sso-mfa/k8s/keycape/deployment.yaml

@@ -15,9 +15,8 @@
 #   4. middleware.yaml + ingress.yaml
 #
 # Container image:
-#   KeyCape has no published image. Build from ~/key-cape/ and push to a registry,
-#   or import directly into K3s (see README.md "Building the image").
-#   Image tag below is a placeholder — update before applying.
+#   KeyCape publishes immutable main-<short-sha> tags through Forgejo Actions.
+#   K3s pulls through the HTTPS Forgejo registry origin.
 
 apiVersion: apps/v1
 kind: Deployment
@@ -49,12 +48,9 @@ spec:
 
       containers:
         - name: keycape
-          # Image published to self-hosted Gitea OCI registry on CoulombCore (KEY-WP-0002).
-          # k3s insecure registry configured for 92.205.130.254:32166 — no pull secret needed.
-          # 2026-05-24: direct-imported into railiance01 k3s for the
-          # bootstrap-console OIDC/MFA rollout. Use IfNotPresent while the
-          # HTTP registry push/pull path is being cleaned up.
-          image: key-cape:mfa-client-20260809
+          # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002).
+          # KEY-WP-0012: canonical OIDC subject resolution for /userinfo.
+          image: forgejo.coulomb.social/coulomb/key-cape:main-153258b
           imagePullPolicy: IfNotPresent
 
           ports: