ci: publish crucible image under deployment/ namespace

registry.westgate.pw/sow/crucible -> /deployment/crucible across build-image
+ release workflows, flake.nix image name, Dockerfile, docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/build-image.yml

@@ -1,5 +1,5 @@
 # Build the Crucible image. PR-first (D7): PRs build only; push to main also
-# publishes registry.westgate.pw/sow/crucible:<git-sha>. Never a mutable tag.
+# publishes registry.westgate.pw/deployment/crucible:<git-sha>. Never a mutable tag.
 #
 # Daemonless: the host-mode runner has no container runtime, so the image is
 # built by Nix (`nix build .#image`, see flake.nix) and pushed with skopeo
@@ -13,7 +13,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   build-image:

.gitea/workflows/release.yml

@@ -10,7 +10,7 @@ on:
 
 env:
   REGISTRY: registry.westgate.pw
-  IMAGE: sow/crucible
+  IMAGE: deployment/crucible
 
 jobs:
   release:
@@ -34,5 +34,5 @@ jobs:
           name: crucible-${{ github.ref_name }}
           path: dist/*
 
-      # TODO(phase-6): re-tag registry.westgate.pw/sow/crucible:<sha> as :<tag>
+      # TODO(phase-6): re-tag registry.westgate.pw/deployment/crucible:<sha> as :<tag>
       # and pin it from sow-platform releases/*.yml once the registry is live.

README.md

@@ -61,7 +61,7 @@ This retires the old habit of checking in `nwn-tool` / `sow-toolkit`.
 PR-first (D7): every check runs on pull requests and on push to `main`.
 
 - `test.yml` — vet, test, shellcheck, yamllint, binary smoke.
-- `build-image.yml` — build `registry.westgate.pw/sow/crucible:<sha>`; publish
+- `build-image.yml` — build `registry.westgate.pw/deployment/crucible:<sha>`; publish
   only on `main`. PRs build but never push. No mutable tags.
 - `release.yml` — tag-gated binary bundles; image re-tag is wired in Phase 6.
 

docker/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 #
-# Crucible toolchain image: registry.westgate.pw/sow/crucible:<git-sha>
+# Crucible toolchain image: registry.westgate.pw/deployment/crucible:<git-sha>
 #
 # Reproducible multi-stage build, no on-VPS build. Produces every cmd/* binary
 # and ships them on a static base. The `crucible` dispatcher is the entrypoint;

docs/consumer-contract.md

@@ -28,7 +28,7 @@ Run the consumer job inside the pinned image and the binaries are on `PATH`:
 
 ```yaml
 container:
-  image: registry.westgate.pw/sow/crucible:<sha>   # pinned, immutable
+  image: registry.westgate.pw/deployment/crucible:<sha>   # pinned, immutable
 ```
 
 No host install, no `$HOME` layout, no developer machine assumptions.

flake.nix

@@ -47,7 +47,7 @@
           default = crucible;
 
           image = pkgs.dockerTools.buildLayeredImage {
-            name = "registry.westgate.pw/sow/crucible";
+            name = "registry.westgate.pw/deployment/crucible";
             tag = version;
             contents = [ crucible pkgs.cacert pkgs.ffmpeg-headless pkgs.fakeNss ];
             config = {