docs: repoint forge references from Codeberg to git.dev.egbt.com

The origin moved to the private Forgejo instance at git.dev.egbt.com
(egbt/secrets). Git history, all 16 branches, 13 tags, and all 13 releases
were migrated with identical SHAs and release bodies.

- CLAUDE.md: replace the "Codeberg operations" section with "Forge
  operations", switching tea invocations to `--login egbt --repo
  egbt/secrets`. Records three things that are easy to get wrong:
  Forgejo's SSH listens on port 2222 (port 22 is the host's own sshd, so
  a bare git@host:path fails with "Permission denied (publickey)"); the
  host is Tailscale-only, so off-VPN failures are connectivity, not
  credentials; and the stale `codeberg` tea login is still configured and
  can be silently fallen back to in non-interactive mode.
- CLAUDE.md: note the instance has an Actions runner available, though no
  workflow is configured yet — local bats remains the merge gate.
- README.md: clone URLs now point at the new host.
- CHANGELOG.md: release links now point at the new host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrUoYuUMoTj91rzV4vxGPB

CLAUDE.md

@@ -138,31 +138,43 @@ Key design decisions (all driven by /autoplan review):
 
 ## Deploy Configuration
 
-- Platform: NONE (distributed via `git clone` from Codeberg)
+- Platform: NONE (distributed via `git clone` from the private Forgejo at `git.dev.egbt.com`)
 - Production URL: N/A (no live service)
 - Release model: merge to `main` is the release. Optionally tagged with `v<X.Y.Z.W>`.
 - Verification after merge: a fresh `git clone` should produce a working `secrets which` against an isolated `$HOME`. No canary URL.
 - Staging: none.
 - Rollback: revert the merge commit on `main` (and delete the tag) to roll back.
 
-## Codeberg operations
+## Forge operations (self-hosted Forgejo)
 
-The remote is Codeberg (Forgejo) — `gh`/`glab` do NOT work here. Use `tea`
-(login name: `codeberg`, user `egbt`) for forge operations when a skill's
+The remote is a private Forgejo instance at `https://git.dev.egbt.com`
+(migrated off Codeberg 2026-09-08). `gh`/`glab` do NOT work here. Use `tea`
+(login name: `egbt`, user `brian`) for forge operations when a skill's
 platform detection comes up "unknown":
 
-**Always pass `--login codeberg --repo egbt/secrets` explicitly.** `tea`'s
-repo autodetection fails here ("remote repository required"), and this machine
-also has an `egbt` login pointing at a *different* forge
-(`https://git.dev.egbt.com`) that `tea` will silently fall back to in
+**Always pass `--login egbt --repo egbt/secrets` explicitly.** `tea`'s repo
+autodetection fails here ("remote repository required"), and this machine also
+has a leftover `codeberg` login pointing at the *old* forge
+(`https://codeberg.org`) that `tea` will silently fall back to in
 non-interactive mode — which would target the wrong server. Confirm with
 `tea logins list` if a command errors.
 
-- PRs: `tea pr create --login codeberg --repo egbt/secrets --base main --head <branch> --title ... --description ...` / `tea pr merge <index> --login codeberg --repo egbt/secrets`
-- Releases: `tea releases create --login codeberg --repo egbt/secrets --tag v<X.Y.Z.W> --title "v<X.Y.Z.W> — <YYYY-MM-DD>" --note ...`
+- PRs: `tea pr create --login egbt --repo egbt/secrets --base main --head <branch> --title ... --description ...` / `tea pr merge <index> --login egbt --repo egbt/secrets`
+- Releases: `tea releases create --login egbt --repo egbt/secrets --tag v<X.Y.Z.W> --title "v<X.Y.Z.W> — <YYYY-MM-DD>" --note ...`
   (convention: one release per tag, title `v<X.Y.Z.W> — <date>`)
-- Issues/status: `tea issues --login codeberg --repo egbt/secrets`, `tea pr list --login codeberg --repo egbt/secrets`
-- No CI on this repo: the bats suite run locally is the merge gate.
+- Issues/status: `tea issues --login egbt --repo egbt/secrets`, `tea pr list --login egbt --repo egbt/secrets`
+- **SSH is on port 2222**, not 22 (port 22 is the host's own sshd). Clone/remote
+  URLs must be `ssh://git@git.dev.egbt.com:2222/egbt/secrets.git`. A bare
+  `git@git.dev.egbt.com:egbt/secrets.git` will fail with "Permission denied
+  (publickey)" because it hits the wrong daemon.
+- The host resolves to a Tailscale address — the forge is reachable only on the
+  VPN. Off-net, push/pull/`tea` all fail to connect; that is expected, not a
+  credentials problem.
+- `FORGEJO_URL` and `FORGEJO_TOKEN` (API token for user `brian`) live in
+  `~/.zshenv` for direct API calls.
+- CI: the instance has an Actions runner available, but no workflow is
+  configured for this repo yet. The bats suite run locally is still the merge
+  gate.
 
 ## Environment variable