Migrate whynot-design npm catalog and docs to Forgejo registry

Update catalog, docs, tests, and exec_delivery comment for Forgejo npm API.

catalog/whynot-design-npm-publish.yaml

@@ -41,7 +41,7 @@ delivery_modes:
 # the engine never hardcodes a registry. Matches coulomb/whynot-design/.npmrc.
 delivery_config:
   npm:
-    registry: "https://gitea.coulomb.social/api/packages/coulomb/npm/"
+    registry: "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
     scope: "@whynot"
     package: "@whynot/design"
     # Package maturity tag. Under the netkingdom publication-scope policy this

docs/cli.md

@@ -13,7 +13,7 @@
 A catalog entry carries `org` + `repo` explicitly (never a bare "owner"), and the
 npm registry/scope live in `delivery_config.npm` as data — the engine never
 hardcodes a registry. The pilot publishes `@whynot/design` from the
-`coulomb/whynot-design` repo to `https://gitea.coulomb.social/api/packages/coulomb/npm/`.
+`coulomb/whynot-design` repo to `https://forgejo.coulomb.social/api/packages/coulomb/npm/`.
 
 ## Install
 

docs/publication-scope-policy.md

@@ -63,7 +63,7 @@ when the backend can only enforce a coarser one.
 ```yaml
 delivery_config:
   npm:
-    registry: "https://gitea.coulomb.social/api/packages/coulomb/npm/"
+    registry: "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
     scope: "@whynot"
     package: "@whynot/design"
     maturity: maturity-build          # feeds the policy

docs/whynot-design-real-publish-closeout.md

@@ -16,7 +16,7 @@ prompts, workplans, or normal logs.
 | Canonical decision | `e6381a56-6b04-4fd5-b2de-f3ef59cde888` |
 | Org/repo | `coulomb/whynot-design` |
 | npm package | `@whynot/design` |
-| npm registry | `https://gitea.coulomb.social/api/packages/coulomb/npm/` |
+| npm registry | `https://forgejo.coulomb.social/api/packages/coulomb/npm/` |
 | Catalog mount/path | `secret/coulomb/whynot-design/npm/publish` |
 | Catalog field | `npm_token` |
 | Injected env var | `NPM_AUTH_TOKEN` |

src/secrets_engine/exec_delivery.py

@@ -92,7 +92,7 @@ def _npm_userconfig(registry: str, scope: str, token_env: str) -> Iterator[Path]
         os.fchmod(fd, 0o600)
         authkey = _registry_authkey(registry)
         with os.fdopen(fd, "w") as fh:
-            # e.g. @whynot:registry=https://gitea.coulomb.social/api/packages/coulomb/npm/
+            # e.g. @whynot:registry=https://forgejo.coulomb.social/api/packages/coulomb/npm/
             fh.write(f"{scope}:registry={registry}\n")
             fh.write(f"{authkey}:_authToken=${{{token_env}}}\n")
         yield path

tests/test_catalog.py

@@ -97,7 +97,7 @@ def test_repo_catalog_loads_and_has_pilot():
     # org=coulomb, repo=whynot-design (not conflated); npm targets Gitea registry
     assert pilot.org == "coulomb"
     assert pilot.repo == "whynot-design"
-    assert pilot.npm["registry"].startswith("https://gitea.coulomb.social/")
+    assert pilot.npm["registry"].startswith("https://forgejo.coulomb.social/")
     assert pilot.npm["scope"] == "@whynot"
     # SECRETS-WP-0003 closeout uses the canonical State Hub decision UUID;
     # the slug-named fixture is retired to offline fallback only.

tests/test_exec_delivery.py

@@ -3,21 +3,21 @@ from secrets_engine.exec_delivery import _npm_userconfig, _registry_authkey
 
 def test_registry_authkey_strips_scheme_and_trails_slash():
     assert (
-        _registry_authkey("https://gitea.coulomb.social/api/packages/coulomb/npm/")
-        == "//gitea.coulomb.social/api/packages/coulomb/npm/"
+        _registry_authkey("https://forgejo.coulomb.social/api/packages/coulomb/npm/")
+        == "//forgejo.coulomb.social/api/packages/coulomb/npm/"
     )
     # missing trailing slash is added
     assert _registry_authkey("https://host/api/npm") == "//host/api/npm/"
 
 
 def test_npm_userconfig_writes_registry_and_token_ref_not_value():
-    registry = "https://gitea.coulomb.social/api/packages/coulomb/npm/"
+    registry = "https://forgejo.coulomb.social/api/packages/coulomb/npm/"
     with _npm_userconfig(registry, "@whynot", "NPM_AUTH_TOKEN") as path:
         body = path.read_text()
         assert f"@whynot:registry={registry}" in body
         # token is referenced via env expansion, never written literally
         assert "${NPM_AUTH_TOKEN}" in body
-        assert "//gitea.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
+        assert "//forgejo.coulomb.social/api/packages/coulomb/npm/:_authToken" in body
         # file is mode 0600
         assert (path.stat().st_mode & 0o077) == 0
     # cleaned up on context exit