Declare the forgejo release unit.

Claims Deployment forgejo/forge and Deployment forgejo/forgejo-runner so rapp-forgejo is no longer the declaration authority.

Assistant: grok
Assistant-Session: 01a1609f-72b8-7222-9dff-fae300115e42

registry/release-units/forgejo.yaml

@@ -0,0 +1,79 @@
+# Source digest is railiance-apps at the commit this declaration was written
+# against. Live Helm release name is forgejo. The package registry runs inside
+# the forge Deployment; it is not a second workload. Image tags that the live
+# Deployment still shows without a digest are not pinned here.
+kind: release-unit
+unit_id: forgejo
+owner: railiance-apps
+contract_version: "1.0.0"
+data_classification: restricted
+criticality: critical
+composition:
+  purpose: "Serves Forgejo git, packages, and the in-cluster Actions runner as one rollout."
+  member_repos:
+    - repo: railiance-apps
+      role: helm values and runner manifest
+      deployables:
+        - forge
+        - forgejo-runner
+    - repo: railiance-forge
+      role: forge operating contracts
+      deployables:
+        - forge
+        - forgejo-runner
+rollout_contract:
+  default_mode: helm-upgrade-install
+smoke_contract:
+  required:
+    - http-ready
+rollback_contract:
+  order:
+    - helm-rollback
+workloads:
+  - kind: Deployment
+    namespace: forgejo
+    name: forge
+  - kind: Deployment
+    namespace: forgejo
+    name: forgejo-runner
+pins:
+  component:
+    name: ocm.railiance.dev/forgejo
+    version: "11.0.3"
+  resources:
+    - name: forgejo
+      type: ociImage
+      version: "11.0.3"
+      digest:
+        hashAlgorithm: SHA-256
+        normalisationAlgorithm: ociArtifactDigest/v1
+        value: "sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba"
+    - name: forgejo-runner
+      type: ociImage
+      version: "11.0.3"
+      digest:
+        hashAlgorithm: SHA-256
+        normalisationAlgorithm: ociArtifactDigest/v1
+        value: "sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b"
+    - name: docker
+      type: ociImage
+      version: "11.0.3"
+      digest:
+        hashAlgorithm: SHA-256
+        normalisationAlgorithm: ociArtifactDigest/v1
+        value: "sha256:aa3df78ecf320f5fafdce71c659f1629e96e9de0968305fe1de670e0ca9176ce"
+  sources:
+    - name: railiance-apps
+      type: git
+      version: "11.0.3"
+      digest:
+        hashAlgorithm: SHA-1
+        normalisationAlgorithm: gitCommit/v1
+        value: "9ecb123451717a4d70ec50d490a228c30ea5ba88"
+    - name: railiance-forge
+      type: git
+      version: "11.0.3"
+      digest:
+        hashAlgorithm: SHA-1
+        normalisationAlgorithm: gitCommit/v1
+        value: "2afdff68b1e22c48c4e7d5f20457f6cc420cb25c"