fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

docs/OPERATIONS.md

@@ -86,6 +86,17 @@ the picker, nothing is retired automatically.
 `docker image prune -f` after a successful apply. The state dir and the token survive `apt remove`;
 `apt purge` deletes them.
 
+## Where the installer downloads from
+
+The primary source is the **scm.tikali.ai generic package registry** of this (public) project:
+`https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd/<ver>/<file>` for
+`monky-deployd_<ver>_amd64.deb`, `.sha256` and `install.sh`; the one-liner fetches the script from
+`https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh`.
+Inside the estate `gitea.cbs.tikali.net` is split-horizon to jump1's RED EIP (`10.10.0.175`), which
+has no HTTP ingress, so backend boxes cannot fetch from the Gitea mirror (cbs/iac#102). Off-estate,
+`install.sh --source gitea` (ansible: `monky_deployd_base_url`/`_deb_url`) uses the Gitea release
+instead. The tag pipeline publishes to both (`release`, `release:gitea`).
+
 ## Publishing a release to Gitea by hand
 
 When `release:gitea` is manual (no `GITEA_TOKEN` in CI) — from jump1 with the Gitea API token:
@@ -100,10 +111,10 @@ for f in monky-deployd_0.1.0_amd64.deb monky-deployd_0.1.0_amd64.deb.sha256 inst
 ```
 
 The assets are then at `https://gitea.cbs.tikali.net/mdella/monky-deployd/releases/download/v0.1.0/<file>`,
-which is what `install.sh` fetches (GitLab artifacts from the tag pipeline's `package` job).
+which is what `install.sh --source gitea` fetches (GitLab artifacts from the tag pipeline's `package` job).
 
 ## Ansible (osg1-07)
 
-`ansible/roles/monky_deployd/` is the role skeleton to copy into osg1-07: `.deb` from the Gitea
-release (sha256-verified), config template, bootstrap grant from a vault var, ACL on the identity,
+`ansible/roles/monky_deployd/` is the role skeleton to copy into osg1-07: `.deb` from the
+scm.tikali.ai package registry (sha256-verified), config template, bootstrap grant from a vault var, ACL on the identity,
 timer, one tick. Rolled to env-dev-06..09 after the env-qa-02 pilot; env-dev-01 last.