fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

README.md

@@ -21,17 +21,22 @@ An admin reveals the kit once in the console (`GET /v1/backends/{id}/agent/insta
 you the enrolment JWT and a one-time **bootstrap deploy grant**. On the box:
 
 ```sh
-curl -fsSL https://gitea.cbs.tikali.net/mdella/monky-deployd/raw/branch/main/packaging/install.sh \
+curl -fsSL https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh \
   | sudo bash -s -- --env env-qa-02 --site cbs --enrol-jwt ./monky-host.env-qa-02.jwt < bootstrap.jwt
-#   [--transport sdk|proxy|system] [--version 0.1.0] [--laptop] [--bao-ca openbao-ca.pem]
+#   [--transport sdk|proxy|system] [--version 0.1.1] [--laptop] [--bao-ca openbao-ca.pem] [--source gitlab|gitea]
 ```
 
 `install.sh` installs `ziti-edge-tunnel` (OpenZiti `jammy` suite) and `docker-compose-plugin` if
-absent, downloads the pinned `.deb` + `.sha256` from the [Gitea release](https://gitea.cbs.tikali.net/mdella/monky-deployd/releases),
+absent, downloads the pinned `.deb` + `.sha256` from the [scm.tikali.ai generic package registry](https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/packages)
+(`https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/monky-deployd_<ver>_amd64.deb`),
 enrols `monky-host.<env>` if the identity is missing, switches the tunneler to `run-host`,
 writes `/etc/monky-deployd/config.yaml`, grants the agent read access to the identity (ACL),
 stages the bootstrap grant (0600), enables `monky-deployd.timer`, runs one tick and deletes the
-JWT. The GitLab project is private, so **the public download is the Gitea mirror**.
+JWT. The GitLab project is **public**, so anonymous downloads work from scm.tikali.ai. Why not the
+Gitea mirror: inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP
+(`10.10.0.175`), which has no HTTP ingress, so backend boxes cannot reach it (cbs/iac#102);
+`--source gitea` (or `MONKY_DEPLOYD_SOURCE=gitea`) keeps the
+[Gitea release](https://gitea.cbs.tikali.net/mdella/monky-deployd/releases) as the off-estate alternative.
 
 ## Transports
 
@@ -140,9 +145,10 @@ systemd-analyze verify packaging/systemd/*.service   # where systemd is availabl
 egress to github.com and pypi.org) and `package` builds the `.deb` with `nfpm` (binary from GitHub
 releases, goreleaser apt repo as fallback). Both were proven on the v0.1.0 tag pipeline and are
 blocking on `main`/tags (manual on MRs); the `.deb` always ships the SDK wheel. On a `v*` tag
-`release` uploads to the GitLab generic package registry + release, and `release:gitea` publishes
-the same assets on the public Gitea mirror (automatic when `GITEA_TOKEN` is set, manual otherwise
-— see `docs/OPERATIONS.md` for the by-hand recipe).
+`release` uploads to the GitLab generic package registry + release (**the primary download**, public
+project), and `release:gitea` publishes the same assets on the Gitea mirror (the `--source gitea`
+alternative; automatic when `GITEA_TOKEN` is set, manual otherwise — see `docs/OPERATIONS.md` for
+the by-hand recipe). Both locations keep being published.
 
 ## See also