refactor(deploy): publish the image to gitea rather than ghcr

The image now sits beside the source it was built from, in gitea's own
registry, and inherits the repository's visibility. The repo is public, so the
cluster pulls with no credentials — which removes the imagePullSecret entirely,
along with the hand-copied GitHub token it depended on and the cross-namespace
copy that kept it alive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -136,17 +136,23 @@ running library:
 ## Deployment
 
 ```
-ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
+gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
 ```
 
+gitea's own registry rather than ghcr, so the image sits beside the source it
+was built from and inherits the repo's visibility. The repo is public, so the
+cluster pulls it with no credentials at all — no `imagePullSecret` to create by
+hand, and no GitHub token to keep in step.
+
 Built from the `Dockerfile` here — two stages, so the runtime image carries no
 build toolchain; non-root, read-only root filesystem, all capabilities dropped.
-The image is built and pushed by hand for now: this repo lives on gitea and
+Built and pushed by hand for now: gitea Actions is not set up on this instance,
-gitea Actions is not set up, so there is no pipeline to do it.
+so there is no pipeline to do it.
 
 ```
-docker build -t ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z .
+docker login gitea.sttlab.eu          # gitea username + a token with package:write
-docker push  ghcr.io/staillanibm/classic-models-agent-catalogue:vX.Y.Z
+docker build -t gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z .
+docker push  gitea.sttlab.eu/stt/classic-models-agent-catalogue:vX.Y.Z
 ```
 
 `k8s/` is what runs; `dev/` is the Flux plumbing that applies it. Three manual
@@ -155,12 +161,6 @@ the source that serves it exist:
 
 ```
 kubectl apply -f k8s/namespace.yaml
-
-# The ghcr package is private. Copy the pull secret classic-models already has:
-kubectl -n classic-models get secret ghcr-pull-secret -o yaml \
-  | sed 's/namespace: classic-models/namespace: agents/' \
-  | kubectl apply -f -
-
 kubectl apply -f dev/gitrepository.yaml
 kubectl apply -f dev/bootstrap-kustomization.yaml
 ```
@@ -176,7 +176,7 @@ What the deployment assumes:
 | Namespace | `agents` — one for the estate; what isolates an agent is its Keycloak client, not its namespace |
 | Secret | `CATALOGUE_CLIENT_SECRET`, from the same Vault entry the realm import reads, through the `vault-keycloak` store |
 | CA | `k8s/ca-configmap.yaml` holds the lab CA **certificate** — public by construction, checked in so the deployment has no hidden prerequisite. Regenerate it when the CA rotates (expires 2026-11-24) |
-| Image pull | `ghcr-pull-secret` in `agents`, created by hand — the package is private |
+| Image pull | none — the gitea package is public, like its repo |
 | DNS | every `*.sttlab.local` name resolves in-cluster already; no `hostAliases` needed |
 | Replicas | exactly one. Conversation history lives in the process, so a second replica would route a user's "yes" to a pod that never saw the question |
 

k8s/deployment.yaml

@@ -18,12 +18,6 @@ spec:
       labels:
         app: catalogue-agent
     spec:
-      # The ghcr package is private, like classic-models-api's. The secret is
-      # created by hand once (see the README) rather than committed or pulled
-      # from Vault — same arrangement classic-models already uses, and the
-      # credential is a GitHub token that belongs to no estate in particular.
-      imagePullSecrets:
-        - name: ghcr-pull-secret
       securityContext:
         runAsNonRoot: true
         runAsUser: 10001
@@ -31,7 +25,12 @@ spec:
           type: RuntimeDefault
       containers:
         - name: agent
-          image: ghcr.io/staillanibm/classic-models-agent-catalogue:v0.1.0
+          # gitea's own registry, not ghcr: the image sits beside the source it
+          # was built from, and the package inherits the repo's visibility. The
+          # repo is public, so the pull needs no credentials — which removes an
+          # imagePullSecret that would otherwise have to be created by hand in
+          # this namespace and kept in step with a GitHub token.
+          image: gitea.sttlab.eu/stt/classic-models-agent-catalogue:v0.1.0
           ports:
             - name: http
               containerPort: 8080