fix(install): fetch from scm.tikali.ai (public project) — Gitea name is split-horizon inside the estate

Inside the estate gitea.cbs.tikali.net resolves to jump1's RED EIP (10.10.0.175),
which has no HTTP ingress, so backend boxes could not download the install
artefacts from the Gitea mirror (cbs/iac#102). scm.tikali.ai is reachable from
those boxes and the project is now public, so the GitLab generic package
registry becomes the PRIMARY source:

- packaging/install.sh: default source = scm.tikali.ai generic package registry
  (projects/69/packages/generic/monky-deployd/<ver>/...); `--source gitea` /
  MONKY_DEPLOYD_SOURCE=gitea keeps the Gitea release as the off-estate
  alternative; --base-url / MONKY_DEPLOYD_BASE_URL still override the base.
- ansible role defaults: monky_deployd_base_url/_deb_url point at the registry,
  Gitea layout kept as a commented alternative.
- README / docs/OPERATIONS.md / CLAUDE.md / CI comments + release description:
  both locations keep being published (release + release:gitea).
- Version 0.1.1 (the tag gate refuses v* tags whose version != __version__);
  tests compare against __version__ instead of a literal. No agent change.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1

packaging/install.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 # monky-deployd installer — Ubuntu 26.04 (verified target).
 #
-#   curl -fsSL https://gitea.cbs.tikali.net/mdella/monky-deployd/raw/branch/main/packaging/install.sh \
-#     | sudo bash -s -- --env env-qa-02 --site cbs [--transport sdk|proxy|system] [--version 0.1.0] \
-#     [--enrol-jwt /path/monky-host.env-qa-02.jwt] [--laptop] < bootstrap.jwt
+#   curl -fsSL https://scm.tikali.ai/tikali/applications/monky/monky-deployd/-/raw/main/packaging/install.sh \
+#     | sudo bash -s -- --env env-qa-02 --site cbs [--transport sdk|proxy|system] [--version 0.1.1] \
+#     [--enrol-jwt /path/monky-host.env-qa-02.jwt] [--laptop] [--source gitlab|gitea] < bootstrap.jwt
 #
 # stdin (or --bootstrap-file): the ONE-TIME bootstrap deploy grant from the install kit
 # (GET /v1/backends/{id}/agent/install). The enrolment JWT is read from --enrol-jwt or
@@ -11,7 +11,8 @@
 #
 # What it does (idempotent):
 #   1. apt: ziti-edge-tunnel (OpenZiti `jammy` suite) if absent, docker-compose-plugin, acl
-#   2. downloads the pinned monky-deployd_<ver>_amd64.deb + .sha256 from the Gitea release, verifies, installs
+#   2. downloads the pinned monky-deployd_<ver>_amd64.deb + .sha256 from the scm.tikali.ai package registry
+#      (--source gitea: the Gitea release, off-estate), verifies, installs
 #   3. enrols /opt/openziti/etc/identities/monky-host.<env>.json if absent (ziti-edge-tunnel enroll),
 #      chown ziti:ziti 0600, switches ziti-edge-tunnel.service to `run-host` via a drop-in
 #   4. writes /etc/monky-deployd/config.yaml, ACLs so user monky-deployd can read the identity,
@@ -20,8 +21,16 @@
 set -euo pipefail
 umask 077
 
-DEFAULT_VERSION="0.1.0"
-BASE_URL="${MONKY_DEPLOYD_BASE_URL:-https://gitea.cbs.tikali.net/mdella/monky-deployd}"
+DEFAULT_VERSION="0.1.1"
+# Download source. PRIMARY is the public GitLab project's generic package registry on scm.tikali.ai:
+# inside the estate gitea.cbs.tikali.net is split-horizon to jump1's RED EIP (10.10.0.175), which has
+# no HTTP ingress, so backend boxes cannot reach the Gitea mirror (cbs/iac#102); scm.tikali.ai they can.
+# `--source gitea` keeps the Gitea release as the off-estate alternative. --base-url / MONKY_DEPLOYD_BASE_URL
+# override the base for whichever layout is selected.
+GITLAB_BASE_URL="https://scm.tikali.ai/api/v4/projects/69/packages/generic/monky-deployd"
+GITEA_BASE_URL="https://gitea.cbs.tikali.net/mdella/monky-deployd"
+SOURCE="${MONKY_DEPLOYD_SOURCE:-gitlab}"
+BASE_URL="${MONKY_DEPLOYD_BASE_URL:-}"
 OPENZITI_SUITE="${OPENZITI_SUITE:-jammy}"
 IDENTITY_DIR="/opt/openziti/etc/identities"
 ETC="/etc/monky-deployd"
@@ -41,6 +50,7 @@ while [ $# -gt 0 ]; do
     --bootstrap-file) BOOTSTRAP_FILE="$2"; shift 2 ;;
     --bao-ca) BAO_CA="$2"; shift 2 ;;
     --base-url) BASE_URL="$2"; shift 2 ;;
+    --source) SOURCE="$2"; shift 2 ;;
     --laptop) LAPTOP="true"; shift ;;
     --no-run) NO_RUN=1; shift ;;
     --force-config) FORCE_CONFIG=1; shift ;;
@@ -56,6 +66,7 @@ done
 SITE="${SITE,,}"
 [[ "$SITE" =~ ^(cbs|pdx)$ ]] || die "site must be cbs|pdx"
 [[ "$TRANSPORT" =~ ^(sdk|proxy|system)$ ]] || die "transport must be sdk|proxy|system"
+[[ "$SOURCE" =~ ^(gitlab|gitea)$ ]] || die "source must be gitlab|gitea"
 IDENTITY="$IDENTITY_DIR/monky-host.$ENV_ID.json"
 export DEBIAN_FRONTEND=noninteractive
 
@@ -98,7 +109,11 @@ if [ "$installed" = "$VERSION" ]; then
 else
   tmp="$(mktemp -d)"; trap 'rm -rf "$tmp"' EXIT
   deb="monky-deployd_${VERSION}_amd64.deb"
-  url="$BASE_URL/releases/download/v${VERSION}"
+  if [ "$SOURCE" = gitlab ]; then
+    url="${BASE_URL:-$GITLAB_BASE_URL}/${VERSION}"
+  else
+    url="${BASE_URL:-$GITEA_BASE_URL}/releases/download/v${VERSION}"
+  fi
   log "downloading $deb from $url"
   curl -fsSL -o "$tmp/$deb" "$url/$deb"
   curl -fsSL -o "$tmp/$deb.sha256" "$url/$deb.sha256"