ci: publish crucible image under deployment/ namespace

registry.westgate.pw/sow/crucible -> /deployment/crucible across build-image
+ release workflows, flake.nix image name, Dockerfile, docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,5 +1,5 @@
 # Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/sow/crucible:<git-sha>. Never a mutable tag.
+# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -13,7 +13,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   build-image:

.gitea/workflows/release.yml

@@ -10,7 +10,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   release:
@@ -34,5 +34,5 @@ jobs:
           name: crucible-${{ github.ref_name }}
           path: dist/*
 
-      # TODO(phase-6): re-tag registry.westgate.pw/sow/crucible:<sha> as :<tag>
+      # TODO(phase-6): re-tag registry.westgate.pw/deployment/crucible:<sha> as :<tag>
       # and pin it from sow-platform releases/*.yml once the registry is live.