fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

.gitlab-ci.yml

@@ -8,6 +8,10 @@
 #
 # CI/CD variables (project or group level):
 #   GITEA_TOKEN   — Gitea API token (write:repository) for `release:gitea`; without it the job is manual
+#
+# Release assets are published to BOTH the GitLab generic package registry (the installer's primary
+# source — the project is public; gitea.cbs.tikali.net is split-horizon inside the estate, cbs/iac#102)
+# and the Gitea mirror release (`install.sh --source gitea`, off-estate).
 #   GITLAB_TRANSLATE_TOKEN — used by the translate-docs component (group level)
 
 include:
@@ -139,7 +143,8 @@ package:
       dotenv: build.env
     expire_in: 90 days
 
-# --- GitLab release (v* tags): generic package registry + release with asset links -------------
+# --- GitLab release (v* tags): generic package registry (the PRIMARY download) + release ---------
+# install.sh / the ansible role fetch ${CI_API_V4_URL}/projects/69/packages/generic/monky-deployd/<ver>/...
 release:
   stage: release
   image:
@@ -155,15 +160,15 @@ release:
     - 'DEB=$(basename dist/*.deb)'
     - >-
       release-cli create --name "monky-deployd $CI_COMMIT_TAG" --tag-name "$CI_COMMIT_TAG"
-      --description "See CHANGELOG.md. Public install assets are on the Gitea mirror: https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/tag/$CI_COMMIT_TAG"
+      --description "See CHANGELOG.md. Install assets: this release's package registry links (primary; the install.sh default) and the Gitea mirror for off-estate use: https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/tag/$CI_COMMIT_TAG"
       --assets-link "{\"name\":\"$DEB\",\"url\":\"$PKG/$DEB\",\"link_type\":\"package\"}"
       --assets-link "{\"name\":\"$DEB.sha256\",\"url\":\"$PKG/$DEB.sha256\",\"link_type\":\"other\"}"
       --assets-link "{\"name\":\"install.sh\",\"url\":\"$PKG/install.sh\",\"link_type\":\"other\"}"
 
-# --- Gitea release (the PUBLIC download the installer uses) ------------------------------------------
-# The GitLab project is private, so install.sh fetches from the Gitea mirror
-# https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v<ver>/... . This job
-# waits for the pull-mirror to carry the tag, creates the release and uploads the assets.
+# --- Gitea release (the off-estate alternative: install.sh --source gitea) -----------------------
+# Same assets at https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v<ver>/... .
+# Not the default: inside the estate that name is split-horizon to jump1's RED EIP (cbs/iac#102).
+# This job waits for the pull-mirror to carry the tag, creates the release and uploads the assets.
 # Automatic when GITEA_TOKEN is set; otherwise a manual, non-blocking job (docs/OPERATIONS.md
 # has the by-hand recipe).
 release:gitea: