T07: full gitea sweep — CoulombCore runs two registry services, not one

gitea.coulomb.social also serves a PyPI package index, so the container-image
finding was half the exposure.

Classified every operational reference by whether anything can still act on it.
Live and must move: reuse-surface's Deployment image, and kaizen-agentic, which
never migrated at all — it publishes to gitea PyPI and its README and five docs
instruct users to pip install from it, with no forgejo equivalent in the repo.
issue-core already dual-publishes and only needs its legacy gitea target retired.

Deliberately left alone: tests asserting historical facts, inventory snapshots,
asset registers and a Dockerfile comment. They record that gitea existed, which
remains true after it is switched off; rewriting them would destroy history to
tidy a grep.

Flagged unswept: CI runners, and any credential lane authenticating to gitea.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

workplans/SHR-WP-0002-predecessor-and-deployment-reality.md

@@ -266,7 +266,55 @@ reference's liveness):
   a chart template recreating it. Worth cleaning, not urgent.
 
 There was **no repository rename**. This is a registry migration (gitea →
-forgejo, early July) in which producers moved and one consumer did not.
+forgejo, early July) in which producers moved and some consumers did not.
+
+### Full sweep, 2026-08-20 — CoulombCore runs *two* registry services
+
+The first pass looked at container images. `gitea.coulomb.social` also serves a
+**PyPI package index** (`/api/packages/coulomb/pypi`), confirmed by
+`railiance-fabric/fabric/interfaces/railiance-forge-python-package-index.yaml`.
+Both die on 2026-08-31.
+
+Sweeping every repo for `gitea.coulomb.social` in operational files (yaml, sh,
+py, Makefile, Dockerfile, toml, json) and classifying by whether anything can
+still act on it:
+
+**Live, must move before 2026-08-31**
+
+| Reference | What breaks |
+| --- | --- |
+| `reuse-surface` Deployment image | Next restart → `ImagePullBackOff`. Also 22 commits stale |
+| `kaizen-agentic` Makefile + README + 5 docs | **Never migrated at all.** Publishes to gitea PyPI and instructs users to `pip install --extra-index-url …gitea…`. No forgejo equivalent exists in the repo |
+
+**Live but already dual-pathed — retire the old half**
+
+| Reference | Note |
+| --- | --- |
+| `issue-core/Makefile:240` publishes to gitea PyPI | Line 250 already publishes to forgejo. The gitea target is legacy and should go |
+
+**Owned by the thing being decommissioned — expected**
+
+`railiance-forge` (`manifests/gitea-ingress.yaml`, `helm/gitea-registry-values.yaml`,
+`tools/gitea-runner-status.sh`) owns gitea itself; these retire *with* it.
+
+**Not live — leave alone**
+
+Tests asserting historical facts (`railiance-fabric`, `markitect-main`,
+`reuse-surface/tests/test_forge_host.py`, `railiance-platform/tests/…`),
+inventory snapshots and asset/data registers (`disaster-control`,
+`domain-tree`, `railiance-fabric` snapshots), agent session blobs, and
+`issue-core/Dockerfile:5` (a comment). These *record* that gitea existed, which
+stays true after it is switched off. Rewriting them would destroy history to
+tidy a grep.
+
+**One to check, not ours:** `railiance-platform/argocd/bootstrap/01-railiance-tenants-project.yaml:14`
+permits `sourceRepos: https://gitea.coulomb.social/coulomb/*.git`. railiance01
+has no ArgoCD `applications` resource type, so this appears inert — but it is a
+bootstrap file and should be confirmed rather than assumed.
+
+**Not swept:** CI runners and any credential lane authenticating *to* gitea.
+`ops-warden`'s catalog carries `forgejo-admin-api-token`; whether a
+gitea-specific equivalent exists was not checked.
 
 `forgejo.coulomb.social` is already on railiance01, so the work is retag, push,
 update manifest. Routed to `railiance-platform`; ownership of the `reuse-surface`