Update Gitea prose to Forgejo; place forge; record ArgoCD as an open decision

Gitea has been replaced by Forgejo. Updates prose mentions in docs/ while
deliberately preserving live names that a blind sweep would have broken:
GITEA_BACKEND_TOKEN is a provisioned OpenBao field in CCR-2026-0002, GITEA_URL
is a Makefile variable, and gitea-db is a running cnpg cluster. Capitalisation
discriminates prose from identifiers. Archived workplans are left as historical
record.

Blueprint 5.2: forge placement decided - workload to rapp-forgejo, layer
responsibility to S4 railiance-enablement, which already declares the handoff
contract and gains its first concrete owned responsibility.

Blueprint 5.6: whether Railiance should use ArgoCD at all is recorded as an open
decision rather than acted on by removing mentions. S3 runs four live ArgoCD
Applications plus AppProjects, and the two most recent commits here add more, so
deleting the documentation would describe a system that does not exist. The
question is real; it needs a decision and a migration, not a docs edit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/credential-lane-lifecycle-runbook.md

@@ -46,8 +46,8 @@ secret value ever appears in Git, State Hub, chat, prompts, or shell history.
   `force-sync`), then restart `deploy/actcore-worker` and
   `deploy/actcore-event-router`, or activity-core emission silently starts
   failing with 401s on the next run.
-- `GITEA_BACKEND_TOKEN` is a scoped Gitea token for service user
-  `issue-core-svc`; rotating it means minting a new token in Gitea first,
+- `GITEA_BACKEND_TOKEN` is a scoped Forgejo token for service user
+  `issue-core-svc`; rotating it means minting a new token in Forgejo first,
   then updating OpenBao — order matters, or ingestion breaks between steps.
 
 ## Lane: llm-connect OpenRouter provider key (`CCR-2026-0003`)