feat(vergabe): deploy from Forgejo OCI registry only

Switch helm values and Makefile image gates to forgejo.coulomb.social;
retire gitea.coulomb.social for vergabe-teilnahme production pulls.

Makefile

@@ -5,6 +5,8 @@ VERGABE_RELEASE   ?= vergabe-teilnahme
 VERGABE_NAMESPACE ?= vergabe-teilnahme
 VERGABE_CHART     ?= charts/vergabe-teilnahme
 VERGABE_VALUES    ?= helm/vergabe-teilnahme-values.yaml
+VERGABE_IMAGE_REPOSITORY ?= forgejo.coulomb.social/coulomb/vergabe-teilnahme
+VERGABE_IMAGE_TAG ?=
 VERGABE_INGRESS   ?= manifests/vergabe-teilnahme-ingress.yaml
 
 VERGABE_DB_SECRET ?= vergabe-app-credentials
@@ -68,6 +70,8 @@ CORE_HUB_IMAGE_TAG ?=
 CORE_HUB_BASE_URL  ?= https://hub.coulomb.social
 CORE_HUB_KUBECONFIG ?= $(PRODUCTION_KUBECONFIG)
 VERGABE_KUBECONFIG ?= $(PRODUCTION_KUBECONFIG)
+VERGABE_IMAGE_REF = $(VERGABE_IMAGE_REPOSITORY):$(VERGABE_IMAGE_TAG)
+VERGABE_IMAGE_SET_ARG = $(if $(strip $(VERGABE_IMAGE_TAG)),--set image.repository=$(VERGABE_IMAGE_REPOSITORY) --set image.tag=$(VERGABE_IMAGE_TAG),)
 CORE_HUB_IMAGE_REF = $(CORE_HUB_IMAGE_REPOSITORY):$(CORE_HUB_IMAGE_TAG)
 CORE_HUB_IMAGE_SET_ARG = $(if $(strip $(CORE_HUB_IMAGE_TAG)),--set image.tag=$(CORE_HUB_IMAGE_TAG),)
 
@@ -157,15 +161,25 @@ apps-pg-backup: check-production-kubeconfig ## Logical pg_dump + age encrypt + N
 
 ##@ Vergabe Teilnahme
 
-vergabe-dry-run: ## helm template render (no apply) for inspection
+check-vergabe-image-tag: ## Require an explicit vergabe-teilnahme image tag for production deploys
+	@test -n "$(VERGABE_IMAGE_TAG)" || { \
+		echo "Set VERGABE_IMAGE_TAG=<sha> for vergabe production deploys." >&2; \
+		echo "Example: VERGABE_IMAGE_TAG=1061f3e make vergabe-deploy" >&2; \
+		exit 1; \
+	}
+
+check-vergabe-image: check-vergabe-image-tag ## Verify the vergabe OCI image exists on Forgejo before deploy
+	tools/check-oci-image.sh "$(VERGABE_IMAGE_REF)"
+
+vergabe-dry-run: check-vergabe-image-tag ## helm template render (no apply) for inspection
 	helm template $(VERGABE_RELEASE) $(VERGABE_CHART) \
 		--namespace $(VERGABE_NAMESPACE) \
-		-f $(VERGABE_VALUES)
+		-f $(VERGABE_VALUES) $(VERGABE_IMAGE_SET_ARG)
 
-vergabe-deploy: check-production-kubeconfig ## Deploy / upgrade vergabe-teilnahme Helm release
+vergabe-deploy: check-production-kubeconfig check-vergabe-image ## Deploy / upgrade vergabe-teilnahme Helm release
 	KUBECONFIG="$(VERGABE_KUBECONFIG)" helm upgrade --install $(VERGABE_RELEASE) $(VERGABE_CHART) \
 		--namespace $(VERGABE_NAMESPACE) --create-namespace \
-		-f $(VERGABE_VALUES) --wait --timeout 3m
+		-f $(VERGABE_VALUES) $(VERGABE_IMAGE_SET_ARG) --wait --timeout 3m
 
 vergabe-ingress-deploy: ## Apply the vergabe-teilnahme ingress (whywhynot.de)
 	kubectl apply -f $(VERGABE_INGRESS)

docs/vergabe-teilnahme.md

@@ -68,13 +68,13 @@ make vergabe-superuser   # interactive createsuperuser
 
 ## Promoting a new image tag
 
-1. Build + push from the `vergabe-teilnahme` repo using the portable package
-   path: `issue-core` resolves from the Gitea PyPI registry, not from a sibling
-   checkout.
-2. Update `image.tag` in `helm/vergabe-teilnahme-values.yaml` to the
-   new git SHA.
-3. `make vergabe-deploy` — Helm rolls a new ReplicaSet with
-   zero-downtime (`maxSurge: 1, maxUnavailable: 0`).
+1. Build + push via Forgejo Actions (`.forgejo/workflows/image.yaml` on push to
+   `main`) or locally:
+   `docker login forgejo.coulomb.social` then build/push
+   `forgejo.coulomb.social/coulomb/vergabe-teilnahme:<sha>`.
+2. Set `VERGABE_IMAGE_TAG=<sha> make vergabe-deploy` (values default repository
+   is `forgejo.coulomb.social/coulomb/vergabe-teilnahme`).
+3. Helm rolls a new ReplicaSet with zero-downtime (`maxSurge: 1, maxUnavailable: 0`).
 4. Verify via `make vergabe-status` and an HTTPS probe.
 5. If migrations are needed, run `make vergabe-migrate` after the
    rollout completes.

helm/vergabe-teilnahme-values.yaml

@@ -3,8 +3,8 @@
 # Secret 'vergabe-teilnahme-env' in the vergabe-teilnahme namespace.
 
 image:
-  repository: gitea.coulomb.social/coulomb/vergabe-teilnahme
-  tag: "1061f3e"           # RAILIANCE-WP-0014-T04 — built locally; push before deploy
+  repository: forgejo.coulomb.social/coulomb/vergabe-teilnahme
+  tag: "1061f3e"           # RAILIANCE-WP-0014-T04 — publish via Forgejo CI / docker push
 
 env:
   DJANGO_SETTINGS_MODULE: vergabe_teilnahme.settings.prod

workplans/RAILIANCE-WP-0014-core-hub-helm-cutover-vergabe-refresh.md

@@ -71,12 +71,12 @@ priority: medium
 state_hub_task_id: "d547f68d-52ec-4ff1-952b-ec70c834e0d3"
 ```
 
-2026-07-11: Built `gitea.coulomb.social/coulomb/vergabe-teilnahme:1061f3e` locally
-from repo HEAD. Registry push returned **403 Forbidden** (docker auth was cleared
-during retry — operator must `docker login gitea.coulomb.social` and push).
-`helm/vergabe-teilnahme-values.yaml` pinned to `1061f3e` with `gitea.coulomb.social`
-repository (matches live cluster pull path). Deploy blocked until push succeeds.
-Live deployment still at `f95de14`; 14-commit drift is docs/agent-guidance only.
+2026-07-11: Migrated deploy target to **Forgejo OCI** (`forgejo.coulomb.social`).
+Added `.forgejo/workflows/image.yaml` in `vergabe-teilnahme`; Makefile
+`check-vergabe-image` gates deploy. `helm/vergabe-teilnahme-values.yaml` uses
+Forgejo repository + tag `1061f3e`. Image must be published to Forgejo (CI push
+to `main` or `docker login forgejo.coulomb.social && docker push`). Gitea registry
+is retired for this app. Live cluster still at `gitea...:f95de14` until deploy.
 
 ## Post-deploy vergabe smoke and runbook evidence