Forgejo registry unreachable from worker nodes (network isolation + host-to-ClusterIP routing gaps). Both management-service and queue-operator now ship from the same public GHCR image, with queue-operator selected via command override.