Correct deploy guide for the Gitea registry retirement (REUSE-WP-0020-T05)

The guide described gitea.coulomb.social as the live registry and its manual
build commands still pushed there. CoulombCore is switched off 2026-08-31.

Also record what the registry actually contains: authenticated tags/list shows
latest, main-bca7165, main-f9d957a and no e3ae22e — so the tag pinned in
railiance-apps/helm/reuse-surface-values.yaml cannot be pulled today, making
ImagePullBackOff a present risk on any restart rather than a future one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/deploy/reuse-kubernetes.md

@@ -4,20 +4,30 @@ Companion to **RAILIANCE-WP-0007** (`railiance-apps` Helm release).
 
 ## Image
 
-This repo's own canonical remote migrated to Forgejo in REUSE-WP-0019-T03
-(`origin` → `forgejo-remote:coulomb/reuse-surface.git`; the old Gitea copy
-is kept read-only, not deleted). Currently deployed production image is
-still `gitea.coulomb.social/coulomb/reuse-surface:e3ae22e` (built manually
-before the migration, per RAILIANCE-WP-0007) — this doc's manual build
-commands still target that registry since that's what's actually live.
-The repo also builds `forgejo.coulomb.social/coulomb/reuse-surface:latest`
-automatically on every push via `.forgejo/workflows/image.yaml`; switching
-the deployed registry over is a deliberate follow-up, not done as part of
-T06.
+**`gitea.coulomb.social` is going away.** CoulombCore, which hosts it, is
+switched off **2026-08-31**. Do not push images there and do not deploy
+anything that references it. Tracked as **REUSE-WP-0020**.
+
+This repo's canonical remote migrated to Forgejo in REUSE-WP-0019-T03
+(`origin` → `forgejo-remote:coulomb/reuse-surface.git`; the old Gitea copy is
+read-only, not deleted). `.forgejo/workflows/image.yaml` builds and pushes
+`forgejo.coulomb.social/coulomb/reuse-surface:latest` and `:main-<short-sha>`
+on every push that touches `Dockerfile`/`reuse_surface/**`/`schemas/**`/
+`pyproject.toml`. Prefer promoting a CI-built tag over building by hand.
+
+`railiance-apps@04be416` already repointed `charts/reuse-surface/values.yaml`
+to the Forgejo repository, but `helm/reuse-surface-values.yaml` still pins
+`image.tag: "e3ae22e"` — a commit from 2026-07-07 18:25, whereas CI only began
+publishing to Forgejo at 21:25 that day. **A Forgejo `:e3ae22e` tag most likely
+never existed**, so the deployment as written risks `ImagePullBackOff` on any
+restart or reschedule today, not only after the retirement date. Verify the tag
+exists before relying on the current manifest. See REUSE-WP-0020-T05.
+
+If you must build by hand:
 
 ```bash
-docker build -t gitea.coulomb.social/coulomb/reuse-surface:<tag> .
-docker push gitea.coulomb.social/coulomb/reuse-surface:<tag>
+docker build -t forgejo.coulomb.social/coulomb/reuse-surface:<tag> .
+docker push forgejo.coulomb.social/coulomb/reuse-surface:<tag>
 ```
 
 ## Required environment
@@ -115,9 +125,9 @@ cert-manager / companion operator logs.
 1. Tag image from CI commit. `.forgejo/workflows/image.yaml` already builds
    and pushes `forgejo.coulomb.social/coulomb/reuse-surface:main-<short-sha>`
    automatically on every push that touches `Dockerfile`/`reuse_surface/**`/
-   `schemas/**`/`pyproject.toml` — verify it's green rather than building
-   by hand, unless promoting from the still-live `gitea.coulomb.social`
-   registry (current production posture).
+   `schemas/**`/`pyproject.toml` — verify it's green rather than building by
+   hand. Confirm the tag exists in the registry before bumping the manifest;
+   `GET /v2/coulomb/reuse-surface/tags/list` needs registry credentials.
 2. Run `pytest -q` and `reuse-surface validate` on that commit (CI already
    does this; re-verify locally if promoting outside CI).
 3. Update Helm values image tag in `railiance-apps`

workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md

@@ -154,12 +154,32 @@ priority: high
 
 Deadline-bound: must land before **2026-08-31**.
 
-1. Verify which tags actually exist in
-   `forgejo.coulomb.social/coulomb/reuse-surface` (registry API needs auth;
-   anonymous `GET /v2/.../tags/list` returns `401`) and that
-   `.forgejo/workflows/image.yaml` is green on `main`.
+1. ~~Verify which tags actually exist.~~ **Done 2026-08-20.** Authenticated
+   against the registry with the workstation's stored Forgejo credentials:
+
+   ```
+   GET /v2/coulomb/reuse-surface/tags/list
+   → {"tags": ["latest", "main-bca7165", "main-f9d957a"]}
+   ```
+
+   **There is no `e3ae22e` tag.** The pinned manifest cannot pull today — this
+   is confirmed, not inferred. `main-f9d957a` (2026-07-08, REUSE-WP-0019-T06)
+   is the newest build; the 10 commits between it and HEAD were docs, workplans,
+   and licence changes that do not match the image workflow's path filters, so
+   no newer image exists yet.
 2. Bump `image.tag` in `railiance-apps/helm/reuse-surface-values.yaml` from
-   `e3ae22e` to a verified Forgejo tag at current HEAD.
+   `e3ae22e` to a verified Forgejo tag.
+
+   **Prefer a build of current HEAD over `main-f9d957a`.** T02's compose
+   hardening is not in `main-f9d957a`, and without it re-enabling
+   `evidence-binder` (T04) would take production to HTTP 500 again. Pushing
+   HEAD touches `reuse_surface/**`, so CI will produce `main-<short-sha>`;
+   deploy that tag. Not pushed yet — pushing to the shared remote needs an
+   explicit go-ahead.
+
+   Left deliberately unmodified for now: writing a tag that has not been built
+   is worse than leaving the current wrong one, since it converts a latent
+   failure into an immediate one on the next reconcile.
 3. Correct `docs/deploy/reuse-kubernetes.md`, which still describes Gitea as
    the live registry and its manual `docker build`/`push` commands still
    target `gitea.coulomb.social`.