fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

ansible/roles/monky_deployd/README.md

@@ -4,7 +4,7 @@ Installs and configures [monky-deployd](https://scm.tikali.ai/tikali/application
 (the Monky backend pull agent, MONKY-ADR-0028) on a docker host that already carries an enrolled
 host identity (`roles/ziti_tunneler`, run-host mode). Skeleton for **osg1-07**; copy it there.
 
-What it does: pin + download the `.deb` from the Gitea release (sha256 verified) → ACL
+What it does: pin + download the `.deb` from the scm.tikali.ai package registry (sha256 verified; `monky_deployd_base_url`/`_deb_url` switch to the Gitea release off-estate) → ACL
 `u:monky-deployd:r` on the identity (`rx` on the dir) → `/etc/monky-deployd/config.yaml` from the
 template → optional openbao-ca PEM → optional `monky-deployd-proxy.service` (`transport: proxy`)
 → the **one-time bootstrap deploy grant** from a vault var (0600, `no_log`) → `monky-deployd.timer`
@@ -14,7 +14,7 @@ template → optional openbao-ca PEM → optional `monky-deployd-proxy.service`
 
 | var | note |
 |---|---|
-| `monky_deployd_version` | pinned release, e.g. `0.1.0` |
+| `monky_deployd_version` | pinned release, e.g. `0.1.1` |
 | `monky_deployd_env_id` / `_site` / `_transport` | per host (`env-dev-06`, `cbs`, `sdk`) |
 | `monky_deployd_bootstrap_grant` | tenancy-minted deploy grant (1 h) — `ansible-vault` or a lookup at play time; empty keeps the existing token |
 | `monky_deployd_bao_ca_pem` | the `openbao-ca` certificate (PEM) |

ansible/roles/monky_deployd/defaults/main.yml

@@ -1,10 +1,15 @@
 ---
 # monky_deployd — install and configure the Monky backend pull agent (MONKY-ADR-0028 §D).
 # Copy this role into osg1-07 (roles/monky_deployd) and roll to env-dev-06..09 after the pilot.
-monky_deployd_version: "0.1.0"
-monky_deployd_base_url: "https://gitea.cbs.tikali.net/mdella/monky-deployd"
+monky_deployd_version: "0.1.1"
 monky_deployd_deb: "monky-deployd_{{ monky_deployd_version }}_amd64.deb"
-monky_deployd_deb_url: "{{ monky_deployd_base_url }}/releases/download/v{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
+# PRIMARY download = the public GitLab project's generic package registry on scm.tikali.ai. Inside the
+# estate gitea.cbs.tikali.net is split-horizon to jump1's RED EIP (10.10.0.175, no HTTP ingress), so
+# backend boxes cannot fetch from the Gitea mirror (cbs/iac#102). Off-estate alternative (Gitea release):
+#   monky_deployd_base_url: "https://gitea.cbs.tikali.net/mdella/monky-deployd"
+#   monky_deployd_deb_url: "{{ monky_deployd_base_url }}/releases/download/v{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
+monky_deployd_base_url: "https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd"
+monky_deployd_deb_url: "{{ monky_deployd_base_url }}/{{ monky_deployd_version }}/{{ monky_deployd_deb }}"
 monky_deployd_deb_sha256_url: "{{ monky_deployd_deb_url }}.sha256"
 
 # per host (inventory / host_vars)

ansible/roles/monky_deployd/tasks/main.yml

@@ -22,7 +22,7 @@
   changed_when: false
   failed_when: false
 
-- name: monky_deployd | download .deb + sha256 from the Gitea release
+- name: monky_deployd | download .deb + sha256 from the scm.tikali.ai package registry
   when: monky_deployd_installed.stdout != monky_deployd_version
   block:
     - name: monky_deployd | fetch sha256