chore(ci): repoint registry/git/cargo meghsakha.com -> breakpilot.com

TLD migration (Phase-3 prep). CI now pushes/pulls against **breakpilot.com** instead of meghsakha.com:
- image registry `repo.meghsakha.com` -> `repo.breakpilot.com` (Harbor, same account)
- git host `gitea.meghsakha.com` -> `git.breakpilot.com` (clone/remote/release-API/insteadOf)
- cargo index `crates.meghsakha.com` -> `crates.breakpilot.com`

Dual-serve means this is a no-op today; it keeps CI working once meghsakha is retired.
Only `.gitea/workflows/*` and `Dockerfile*` touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -114,7 +114,7 @@ jobs:
   image:
     # Builds the portal image and ships it through the same path every
     # other service in orca-infra uses: push :latest + :sha-<sha> to
-    # repo.meghsakha.com, then POST a github-style payload to the
+    # repo.breakpilot.com, then POST a github-style payload to the
     # orca webhook so the master pulls and redeploys breakpilot-portal.
     #
     # Webhook target (registered once on the master via
@@ -128,20 +128,20 @@ jobs:
       - uses: actions/checkout@v4
       - uses: docker/login-action@v3
         with:
-          registry: repo.meghsakha.com
+          registry: repo.breakpilot.com
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASS }}
       - uses: docker/build-push-action@v6
         with:
           push: true
           tags: |
-            repo.meghsakha.com/breakpilot/portal:latest
-            repo.meghsakha.com/breakpilot/portal:sha-${{ github.sha }}
+            repo.breakpilot.com/breakpilot/portal:latest
+            repo.breakpilot.com/breakpilot/portal:sha-${{ github.sha }}
       - name: sign image (cosign)
         run: |
           { command -v cosign >/dev/null 2>&1 || curl -sSfLo /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64 || wget -qO /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.4.3/cosign-linux-amd64; } || echo "::warning::cosign fetch failed"
           chmod +x /usr/local/bin/cosign 2>/dev/null || true
-          cosign sign --yes --key env://COSIGN_KEY repo.meghsakha.com/breakpilot/portal:latest || echo "::warning::cosign failed"
+          cosign sign --yes --key env://COSIGN_KEY repo.breakpilot.com/breakpilot/portal:latest || echo "::warning::cosign failed"
       - name: trigger orca redeploy
         # Signs the POST with HMAC-SHA256 over the JSON body using the
         # secret orca generated when the webhook was registered. Orca's

.gitea/workflows/release.yaml

@@ -67,7 +67,7 @@ jobs:
           curl -X POST -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
             -H "Content-Type: application/json" \
             -d "$(jq -Rs '{tag_name:"v${{ steps.v.outputs.version }}", name:"v${{ steps.v.outputs.version }}", body:.}' < RELEASE_NOTES.md)" \
-            https://gitea.meghsakha.com/api/v1/repos/${{ github.repository }}/releases
+            https://git.breakpilot.com/api/v1/repos/${{ github.repository }}/releases
 
   rollback-on-failure:
     needs: promote