Add Forgejo T05 verify, operator bootstrap, and security hardening

Introduce forgejo-verify acceptance checks, idempotent operator bootstrap,
runner registration SOPS capture helper, and session/security Helm values.

docs/forgejo-package-registry.md

@@ -0,0 +1,81 @@
+# Forgejo Package Registry (railiance01)
+
+Workplan: `RAIL-HO-WP-0005` T07 · Decision: Option C (OCI + npm + generic)
+
+Public host: `https://forgejo.coulomb.social`
+
+Helm values: `helm/forgejo-registry-values.yaml` (`packages.ENABLED`, `ROOT_URL`).
+
+## OCI (container images)
+
+Registry API: `GET /v2/` (expect `401` + `Docker-Distribution-Api-Version`).
+
+```bash
+docker login forgejo.coulomb.social -u tegwick
+docker tag IMAGE forgejo.coulomb.social/coulomb/REPO:TAG
+docker push forgejo.coulomb.social/coulomb/REPO:TAG
+```
+
+Cluster pull (railiance01):
+
+```bash
+KUBECONFIG=~/.kube/config-hosteurope crictl pull forgejo.coulomb.social/coulomb/REPO:TAG
+```
+
+Smoke: `make forgejo-smoke`
+
+## npm
+
+Org registry: `https://forgejo.coulomb.social/api/packages/coulomb/npm/`
+
+Workstation config (use a PAT with `read:package` / `write:package`; do not commit):
+
+```bash
+npm config set @coulomb:registry https://forgejo.coulomb.social/api/packages/coulomb/npm/
+npm config set -- '//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken' "${FORGEJO_NPM_TOKEN}"
+```
+
+Publish (scoped package under `@coulomb/`):
+
+```bash
+npm publish --scope=@coulomb
+# or explicit:
+npm publish --scope=@coulomb --registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
+```
+
+Install:
+
+```bash
+npm install @coulomb/PACKAGE@VERSION
+```
+
+Probe package (T07 evidence): `@coulomb/forgejo-npm-probe@0.0.1`
+
+Smoke: `make forgejo-npm-smoke` (requires `FORGEJO_NPM_TOKEN` or `/tmp/forgejo-tegwick-api-token`)
+
+CI template: `railiance-enablement/workflows/npm-publish.yaml`
+
+## Generic packages
+
+Upload release artifacts via Forgejo UI or API (`/api/packages/{owner}/generic/...`).
+Use for binaries, checksum files, and non-OCI release assets.
+
+## Retention and backup
+
+| Type | Storage | Backup | Cleanup |
+| --- | --- | --- | --- |
+| OCI | `/data/packages` in Forgejo PVC | `make forgejo-backup` (`forgejo dump`) | Delete unused tags in UI; no auto-prune yet |
+| npm | same | same | `npm unpublish @coulomb/pkg@version` or UI package settings |
+| generic | same | same | per-package UI delete |
+
+Package blobs are included in daily `forgejo dump` (~686M with 14 repos, 2026-07-07).
+Restore drills must verify package metadata after isolated restore (T09).
+
+RPO/RTO for package data matches Forgejo backup policy: 24h / 4h
+(`the-custodian/docs/forgejo-production-decisions.md` § Backup).
+
+## Related
+
+- `docs/forgejo-on-railiance01.md`
+- `railiance-enablement/docs/forgejo-actions-workflow-templates.md`
+- Gitea legacy reference: `~/railiance-forge/docs/gitea-package-registry.md`