REUSE-WP-0019-T03: record CI migration and org webhook status

Credits railiance-apps for the org-level Forgejo webhook (they picked it
up after I flagged the /health ingress bug via State Hub, and reused the
same K8s Secret value rather than inventing a new one). Records this
repo's own migration: created on Forgejo (private:false, matching every
other migrated repo -- confirmed via API, then got explicit user sign-off
specifically on that parameter), ci.yml/ci-smoke.yaml/image.yaml all
verified green on the live push, recompose-fallback.yaml deployed but
blocked on a repo secret write pending separate sign-off (same boundary as
the T02 K8s Secret write). Gitea remote kept read-only per the migration
playbook's safety contract, not deleted.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md

@@ -189,21 +189,73 @@ production ingress template edit outside this workplan's scope.
 
 ```task
 id: REUSE-WP-0019-T03
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "aa9e9f80-b878-490c-832e-515d8cbbbb60"
 ```
 
-Blocked on T02 deploy and Forgejo instance availability.
+**Org-level Forgejo webhook — done by `railiance-apps` (2026-07-07),
+credited not claimed:** after I flagged the `/health` ingress bug to
+`railiance-apps` via State Hub message, they picked up this piece too:
+`tools/reuse-forgejo-webhook.sh` + `make reuse-forgejo-webhook`
+(idempotent, reads the same `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` I put
+in the K8s Secret directly from the live cluster, never prints it).
+Verified live: `GET /api/v1/orgs/coulomb/hooks` shows hook id `1`, active,
+`push` events only, pointed at `https://reuse.coulomb.social/v1/webhooks/forgejo`.
 
-- Org-level Forgejo webhook (single config, all repos) → hub
-  `/v1/webhooks/forgejo`, push events only
-- Fallback: Forgejo Actions scheduled workflow (cron) in this repo calling
-  `POST /v1/recompose`; also serves repos during any Gitea-remnant window
-- Migrate this repo's CI `.gitea/workflows/ci.yml` → `.forgejo/workflows/ci.yml`
-  (Forgejo Actions; verify runner labels); document the pattern for siblings
-- Verify end-to-end: index change in a sibling repo → hub `composed_at`
-  advances without manual compose
+**Migrated this repo's own CI, following the existing tier-3 playbook
+(`the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`,
+`railiance-enablement/docs/forgejo-actions-workflow-templates.md` — used
+proven patterns rather than improvising):**
+
+- Created `coulomb/reuse-surface` on Forgejo (`private: false`, matching
+  every other migrated repo including `state-hub`/`activity-core` —
+  confirmed via API before asking, then got explicit user sign-off on the
+  visibility choice specifically, since the auto-mode classifier correctly
+  flagged "public" as an inferred parameter beyond the general migrate
+  instruction)
+- `.forgejo/workflows/ci.yml`: ported `.gitea/workflows/ci.yml` verbatim
+  in behavior, but using archive checkout (`wget`+`tar` + `apt install
+  python3`) instead of `actions/checkout@v4` — this runner's
+  `ubuntu-latest` label maps to `docker://node:20-bookworm` with no Python
+  preinstalled and no proven checkout-action support on this substrate
+- `.forgejo/workflows/ci-smoke.yaml`: routing probe, copied from the
+  canonical template (matches sibling convention)
+- `.forgejo/workflows/image.yaml`: container build/push to
+  `forgejo.coulomb.social/coulomb/reuse-surface` (canonical single-repo
+  template, org secrets `REGISTRY_USER`/`REGISTRY_TOKEN` already existed)
+- `.forgejo/workflows/recompose-fallback.yaml`: scheduled (every 6h) `POST
+  /v1/federated/compose` as a backstop per design principle 3 ("degrade to
+  schedule") — the webhook above is the primary path; no separate
+  `/v1/recompose` route exists (see T02 note)
+- Removed `.gitea/workflows/ci.yml` (dead once `origin` moves; matches how
+  `state-hub`/`activity-core`/etc. left no `.gitea/workflows/` behind)
+- `origin` → `forgejo-remote:coulomb/reuse-surface.git`, old remote
+  renamed to `gitea` (kept, read-only, frozen at commit `ac81490` — safety
+  contract from the migration playbook: never delete the Gitea copy)
+- **Live-verified all three workflows green** on the actual push: `ci.yml`
+  (`validate-registry`, real pytest+validate suite) success; `ci-smoke.yaml`
+  (`host-smoke` + `container-smoke`) success; `image.yaml`
+  (`build-and-push`) success — confirmed `reuse-surface:latest` and
+  `reuse-surface:main-09d5b0f` both landed in the Forgejo container
+  registry via the packages API
+
+**Blocked, needs separate explicit sign-off (same boundary as the K8s
+Secret write in T02):** adding the `REUSE_SURFACE_TOKEN` repo secret to
+Forgejo Actions (needed by `recompose-fallback.yaml` to call the
+authenticated compose endpoint) was denied by the auto-mode classifier as
+a secret-provisioning action distinct from "migrate to Forgejo" — did not
+attempt to work around it. The fallback workflow is deployed and will fail
+safely (not silently) until that secret is added; the webhook is the
+primary mechanism and is already fully live, so this is a low-priority gap.
+
+**Not done — moved out of this workplan's scope:** updating
+`docs/deploy/reuse-kubernetes.md`/`railiance-apps` to make
+`forgejo.coulomb.social` the canonical *production deploy* image registry
+(vs. the current live pod, which still runs the `gitea.coulomb.social`
+image built in T02 and is working fine). Didn't force another production
+redeploy in this same pass; the Forgejo image pipeline is proven and ready
+whenever a future deploy wants to switch registries.
 
 ## Reuse Telemetry Store And Recording
 
@@ -261,12 +313,12 @@ state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
 
 ## Acceptance
 
-- [ ] No hardcoded forge host in code or sources.yaml; `migrate-host` tested
-- [ ] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place
-- [ ] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`)
+- [x] No hardcoded forge host in code or sources.yaml; `migrate-host` tested (T01, 2026-07-07)
+- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — webhook live-verified end to end; scheduled fallback deployed, blocked only on a repo secret pending separate sign-off)
+- [x] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) (T03, 2026-07-07 — `ci.yml`/`ci-smoke.yaml`/`image.yaml` all verified green on the live push)
 - [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them
 - [ ] R-axis evidence rules for observed reuse documented in the maturity standard
-- [ ] Hub freshness visible (`composed_at`, stale flag) in API and stats
+- [x] Hub freshness visible (`composed_at`, stale flag) in API and stats (T02, 2026-07-07)
 
 ## Out of scope