fix: retire stale forge deploy targets and update runtime references

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a198e4-7903-75b3-aaf3-c89ddac9437d

docs/backup-restore-secret-handoff.md

@@ -1,5 +1,7 @@
 # Backup, Restore, And Secret Handoff
 
+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Last reviewed: 2026-06-05
 
 Status: contract v1. This document defines ownership, evidence gates, and
@@ -32,7 +34,7 @@ S5 application releases can trust without taking custody of forge secrets.
 
 | Asset | Current anchor | Forge responsibility | Platform/lower-layer responsibility | Trust gate |
 | --- | --- | --- | --- | --- |
-| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make gitea-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks |
+| Gitea application database | CNPG cluster `databases/gitea-db`, checked by `make forge-status` | State what must be restorable and what forge checks prove after restore | CNPG backup/restore implementation and database recovery mechanisms | Restored database must support login, repo list, package metadata, and registry metadata checks |
 | Gitea shared storage | PVC `default/gitea-shared-storage`, mounted at `/data`; package blobs under `/data/packages` | Track package/blob growth, retention posture, and restore requirements | Durable volume backup, object-storage export, or future storage replication | Restored storage must support Git clone, package download/install, and container pull checks |
 | Source repositories and forge app state | Gitea database plus `/data` storage | Define restore drill scope and consumer evidence | Database/PVC/object-storage restore tooling | Non-production restore drill proves a known repo can be cloned after restore |
 | Container and Python package registry data | Package blobs under `/data/packages`; metadata in Gitea database | Define retention, cleanup, package evidence, and consumer verification gates | Durable backup of blobs and metadata | Known image/package can be pulled or installed after restore |

docs/current-forge-asset-inventory.md

@@ -1,5 +1,7 @@
 # Current Forge Asset Inventory
 
+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05
 
 This inventory covers forge-related assets that were originally visible in

docs/deploy-capable-gitea-move-review.md

@@ -1,5 +1,7 @@
 # Deploy-Capable Gitea Move Review
 
+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05
 
 Status: executed as a file ownership move. No live Helm deploy, SOPS

docs/first-migration-plan.md

@@ -1,5 +1,7 @@
 # First Migration Plan
 
+> **2026-10-21 (FORGE-WP-0009):** the Gitea-chart deploy assets named here (the encrypted and registry Gitea values, `manifests/gitea-ingress.yaml`, `releases/gitea/values.yaml`, `make gitea-deploy`, `make gitea-ingress-deploy`) were retired. The live forge release source is railiance-apps; this repo observes it. The rest of this document is kept as a record.
+
 Date: 2026-06-05
 
 Status: Phases 1 through 3 are complete as file ownership moves. No live Helm

docs/forgejo-actions-runner-substrate.md

@@ -44,7 +44,7 @@ make forgejo-runner-status
 make forgejo-smoke
 
 # Generate registration token (in cluster; do not log token)
-KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forgejo-gitea -- \
+KUBECONFIG=~/.kube/config-hosteurope kubectl exec -n forgejo deploy/forge -- \
   forgejo actions generate-runner-token --scope coulomb
 ```
 

docs/gitea-container-registry.md

@@ -14,8 +14,8 @@ Do not use raw node IP HTTP ports for web or registry traffic; the Gitea HTTP
 Service is internal-only and the public standard is the HTTPS host.
 
 Registry-specific Gitea settings are carried in
-`helm/gitea-registry-values.yaml`, a non-secret overlay applied after the SOPS
-values file by `make gitea-deploy`. It explicitly enables packages, permits
+`railiance-apps/helm/forgejo-registry-values.yaml`, a non-secret overlay applied after the SOPS
+values file by `make forgejo-deploy` in railiance-apps. It explicitly enables packages, permits
 container and PyPI uploads without an app-level size cap, clears globally
 disabled repo units, and keeps `ROOT_URL` on the HTTPS host.
 

docs/gitea-package-registry.md

@@ -4,15 +4,15 @@ This is the canonical Railiance operating note for the current Gitea Python
 package registry. Compatibility pointers remain in `railiance-apps`;
 deploy-capable Gitea Helm and manifest files now live in this repo.
 
-Gitea package support is enabled by `helm/gitea-registry-values.yaml`. That
-overlay is applied after the encrypted base values by `make gitea-deploy` and
+Gitea package support is enabled by `railiance-apps/helm/forgejo-registry-values.yaml`. That
+overlay is applied after the encrypted base values by `make forgejo-deploy` in railiance-apps and
 enables both container packages and Python packages.
 
 The public ingress exposes the Gitea web route at
 `https://gitea.coulomb.social/`, the Python package route at `/api/packages`,
 and the OCI registry route at `/v2`. The standard endpoint is HTTPS; if package
 simple-index pages render `http://gitea.coulomb.social/...` artifact links,
-reconcile the Gitea Helm release with `helm/gitea-registry-values.yaml` so
+reconcile the Gitea Helm release with `railiance-apps/helm/forgejo-registry-values.yaml` so
 `ROOT_URL` is restored to the HTTPS host.
 
 Status on 2026-06-13: the root web route returns `200`, live `ROOT_URL` is

docs/initial-operating-contracts.md

@@ -86,7 +86,7 @@ leaving live deploy and secret custody changes behind separate review gates.
 
 ## Observability And Evidence
 
-- `make gitea-status` is the first read-only operator check in this repo.
+- `make forge-status` is the first read-only operator check in this repo.
 - Forge health should cover web, Git SSH, container registry, Python package
   registry, database, package storage, and runner status.
 - Downstream app release evidence should cite forge artifact evidence rather

docs/observability-operating-evidence.md

@@ -37,7 +37,7 @@ This contract defines:
 
 ## Read-Only Health Checks
 
-Run `make gitea-status` first. It checks the Gitea pod, Service, Ingress, and
+Run `make forge-status` first. It checks the Gitea pod, Service, Ingress, and
 CNPG-backed `gitea-db` status when the operator has a kubeconfig pointed at the
 Railiance cluster.
 
@@ -141,7 +141,7 @@ What to look for:
 
 Dashboard expectations:
 
-- Current state: manual checks and `make gitea-status` are the authoritative
+- Current state: manual checks and `make forge-status` are the authoritative
   operator path.
 - Next state: forge should publish signal definitions that a future dashboard
   can render without changing ownership boundaries.
@@ -183,7 +183,7 @@ when any of these occur:
 - `/v2/` no longer returns an OCI registry response.
 - PyPI endpoint returns 5xx or package install checks fail for a published
   release package.
-- `make gitea-status` shows unavailable pods, missing Service/Ingress, or an
+- `make forge-status` shows unavailable pods, missing Service/Ingress, or an
   unhealthy `gitea-db`.
 - Package/blob usage crosses the warning or action thresholds above.
 - Runner labels required by S4 templates or S5 checks disappear.