fix(ci): rename .forgejo to .gitea, use golang runner with docker container

docs/PLAN-atlas.md

@@ -40,8 +40,8 @@ Verified problems, in the order they must be fixed:
 | # | Problem | Evidence |
 |---|---|---|
 | 0.1 | `portfolio` namespace is empty; `portfolio` and `auth-infra` Applications do not exist in the cluster | `kubectl get pods -n portfolio` → no resources; neither name appears in `kubectl get app -n argocd` |
-| 0.2 | `infra/argocd-apps.yaml` `repoURL` = `forgejo.riotpiao.homelab.com` — NXDOMAIN | `dig` |
-| 0.3 | Deployment image `forgejo.riotpiao.homelab.com/rock/portfolio:latest` — dead host, and `:latest` + `imagePullPolicy: IfNotPresent` means a pushed image will never roll out | `infra/portfolio/base/deployment.yaml` |
+| 0.2 | `infra/argocd-apps.yaml` `repoURL` = `forgejo.riotpiao.com` — NXDOMAIN | `dig` |
+| 0.3 | Deployment image `forgejo.riotpiao.com/rock/portfolio:latest` — dead host, and `:latest` + `imagePullPolicy: IfNotPresent` means a pushed image will never roll out | `infra/portfolio/base/deployment.yaml` |
 | 0.4 | `forgejo-gitea` stuck `Init:0/3` for 3h — no image builds possible | `kubectl get pods -n cicd` |
 | 0.5 | `riotpiao.com` returns HTTP 403 from the Cloudflare edge; no origin headers present | `curl -I https://riotpiao.com` |
 | 0.6 | No test framework installed — TDD is impossible as the repo stands | `package.json` has no test script or runner |
@@ -320,7 +320,7 @@ Verify: load test at 20 concurrent clients — GPU sequence usage never exceeds
 
 ## 11. Decisions needed before Phase 1
 
-1. **Which GitOps repo owns the portfolio** — GitHub (`riotpiao.homelab.com`) or Forgejo? Blocks 0.1–0.3.
+1. **Which GitOps repo owns the portfolio** — GitHub (`riotpiao.com`) or Forgejo? Blocks 0.1–0.3.
 2. **Apex 403 cause** — tunnel route, WAF rule, or no origin? Blocks 0.5.
 3. **Is `homarr` still wanted?** Deployed and healthy, but from the abandoned plan.
 4. **Does chat stay in v1?** Given the 8-slot ceiling, shipping B + E + C first and treating D as a separate decision is defensible.

docs/adr/ADR-0001-atlas-cluster-visualization.md

@@ -33,7 +33,7 @@ Goal: replace fabricated claims with a live, interactive, public view of the rea
 **GitOps**
 
 - `homelab-root` is an app-of-apps: 31 child `Application` resources
-- Source: `[email protected]:Riotpiaole/riotpiao.homelab.com.git`, path `k8s/argocd/apps`
+- Source: `[email protected]:Riotpiaole/riotpiao.com.git`, path `k8s/argocd/apps`
 - Sync waves **0 → 8** already annotated across apps
 - ~550 managed resources total (largest: `prometheus` 68, `cert-manager` 47, `kong` 39)
 
@@ -273,7 +273,7 @@ Surface E precedes C and D deliberately: it reuses Phase 1 data wholesale and is
 
 **Open questions requiring an answer before Phase 1**
 
-1. **Two GitOps roots exist.** `homelab-root` reads `[email protected]:Riotpiaole/riotpiao.homelab.com.git`. This repo's `infra/argocd-apps.yaml` points at `forgejo.riotpiao.homelab.com` — a hostname that does not resolve — and its `portfolio` and `auth-infra` Applications **do not exist in the cluster**. Which repository is authoritative for the portfolio?
+1. **Two GitOps roots exist.** `homelab-root` reads `[email protected]:Riotpiaole/riotpiao.com.git`. This repo's `infra/argocd-apps.yaml` points at `forgejo.riotpiao.com` — a hostname that does not resolve — and its `portfolio` and `auth-infra` Applications **do not exist in the cluster**. Which repository is authoritative for the portfolio?
 2. **Apex returns 403 from the Cloudflare edge.** Is this an absent tunnel public-hostname route, a WAF rule, or a proxied record with no origin? The portfolio cannot ship until this is understood.
 3. Is `homarr` still wanted? It is deployed and healthy, but the plan it came from is abandoned.
 4. Does the chat surface stay in scope given the 8-slot ceiling, or ship topology + delivery + terminal first and treat chat as a separate decision?