Release: the dev organization's registry, pushed by registry-push

The repository moved to the dev organization: images go to
gitea.dongar.net/dev/nisse-dev, pushed by the registry-push bot with the
organization's REGISTRY_TOKEN.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

.gitea/workflows/release.yml

@@ -1,23 +1,26 @@
 name: Release
 # A published release builds the agent's image and pushes it to Gitea's
-# registry (Development Plan M1.5, X4): gitea.dongar.net/dongar/nisse-dev
+# registry (Development Plan M1.5, X4): gitea.dongar.net/dev/nisse-dev
 # tagged with the version (the release tag without its v) and latest. Cut a
 # release in Gitea (Releases → New release, tag vX.Y.Z); a tag pushed for any
 # other reason builds nothing.
 #
 # The registry needs a personal access token with write:package
-# (REGISTRY_TOKEN), never the built-in job token: Gitea's registry resolves
+# (REGISTRY_TOKEN, an organization secret of `dev`, belonging to the
-# an Actions job token to an empty package scope (go-gitea/gitea#23642 and
+# registry-push bot), never the built-in job token: Gitea's registry
-# others). Packages belong to the repository's owner. Never on pull_request:
+# resolves an Actions job token to an empty package scope (go-gitea/gitea
-# registry credentials stay off that trigger.
+# #23642 and others). Packages belong to the repository's owner, which is
+# why this repository is the `dev` organization's: the bot writes packages
+# through the org's registry-push team. Never on pull_request: registry
+# credentials stay off that trigger.
 on:
   release:
     types: [published]
 
 env:
   REGISTRY: gitea.dongar.net
-  REGISTRY_USER: dongar  # the token's account
+  REGISTRY_USER: registry-push  # the token's account
-  IMAGE: gitea.dongar.net/dongar/nisse-dev
+  IMAGE: gitea.dongar.net/dev/nisse-dev
 
 jobs:
   build-and-push:

docs/Development-Plan.md

@@ -281,8 +281,8 @@ accepted once a tag's image passes the e2e suite.
   mounted at `/etc/nisse-dev/nisse-dev.yaml`, secrets as environment variables,
   keys mounted read-only. Its `test` stage carries the tests over the installed
   package, for `scripts/e2e.sh --image REF`. CI builds both on every PR;
-  `release.yml` pushes `gitea.dongar.net/dongar/nisse-dev:<tag>` and `:latest`
+  `release.yml` pushes `gitea.dongar.net/dev/nisse-dev:<version>` and `:latest`
-  (`REGISTRY_TOKEN`).
+  on a published release (`REGISTRY_TOKEN`, the `dev` organization's).
 - The live bring-up's switch to the image waits for the next live test (it needs
   its own test repository too); `bringup.sh plan` shows what it will run.