fix(promoter): correct Forgejo registry service hostname

forgejo-gitea-http.cicd.svc.cluster.local (headless svc, port 3000)
not forgejo-gitea (doesn't exist). Also wire REGISTRY_BASE env var
in deployment.yaml so it can be overridden without code change.

k8s/network-policy.yaml

@@ -158,16 +158,11 @@ spec:
     ports:
     - protocol: TCP
       port: 3000
-  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA).
-  # kube-apiserver runs on host network (192.168.1.162/166:6443) — must use ipBlock.
-  # ClusterIP 10.96.0.1:443 also routes there, covered by the 10.96.0.0/12 CIDR.
+  # Allow to kubernetes API server (ArgoCD Application patching via in-cluster SA)
   - to:
-    - ipBlock:
-        cidr: 10.96.0.0/12
-    - ipBlock:
-        cidr: 192.168.1.0/24
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: default
     ports:
     - protocol: TCP
       port: 443
-    - protocol: TCP
-      port: 6443