refactor(deploy): publish the image to gitea rather than ghcr

The image now sits beside the source it was built from, in gitea's own
registry, and inherits the repository's visibility. The repo is public, so the
cluster pulls with no credentials — which removes the imagePullSecret entirely,
along with the hand-copied GitHub token it depended on and the cross-namespace
copy that kept it alive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

k8s/deployment.yaml

@@ -18,12 +18,6 @@ spec:
       labels:
         app: catalogue-agent
     spec:
-      # The ghcr package is private, like classic-models-api's. The secret is
-      # created by hand once (see the README) rather than committed or pulled
-      # from Vault — same arrangement classic-models already uses, and the
-      # credential is a GitHub token that belongs to no estate in particular.
-      imagePullSecrets:
-        - name: ghcr-pull-secret
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001
@@ -31,7 +25,12 @@ spec:
           type: RuntimeDefault
       containers:
         - name: agent
-          image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
+          # gitea's own registry, not ghcr: the image sits beside the source it
+          # was built from, and the package inherits the repo's visibility. The
+          # repo is public, so the pull needs no credentials — which removes an
+          # imagePullSecret that would otherwise have to be created by hand in
+          # this namespace and kept in step with a GitHub token.
+          image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
           ports:
             - name: http
               containerPort: 8080