docs: repoint forge references from Codeberg to git.dev.egbt.com

The origin moved to the private Forgejo instance at git.dev.egbt.com
(egbt/secrets). Git history, all 16 branches, 13 tags, and all 13 releases
were migrated with identical SHAs and release bodies.

- CLAUDE.md: replace the "Codeberg operations" section with "Forge
  operations", switching tea invocations to `--login egbt --repo
  egbt/secrets`. Records three things that are easy to get wrong:
  Forgejo's SSH listens on port 2222 (port 22 is the host's own sshd, so
  a bare git@host:path fails with "Permission denied (publickey)"); the
  host is Tailscale-only, so off-VPN failures are connectivity, not
  credentials; and the stale `codeberg` tea login is still configured and
  can be silently fallen back to in non-interactive mode.
- CLAUDE.md: note the instance has an Actions runner available, though no
  workflow is configured yet — local bats remains the merge gate.
- README.md: clone URLs now point at the new host.
- CHANGELOG.md: release links now point at the new host.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BrUoYuUMoTj91rzV4vxGPB

CHANGELOG.md

@@ -475,6 +475,6 @@ and this project adheres to a four-digit MAJOR.MINOR.PATCH.MICRO version scheme.
 
 - 37 → 66 tests. New coverage: store resolution rules and precedence, walk-up boundaries, command-injection prevention, key-file re-derivation across stores, teammate-onboarding error path, monorepo workspace binding, F1–F5 adversarial regressions.
 
-[0.1.1.0]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.1.0
-[0.1.0.1]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.0.1
-[0.1.0.0]: https://codeberg.org/egbt/secrets/releases/tag/v0.1.0.0
+[0.1.1.0]: https://git.dev.egbt.com/egbt/secrets/releases/tag/v0.1.1.0
+[0.1.0.1]: https://git.dev.egbt.com/egbt/secrets/releases/tag/v0.1.0.1
+[0.1.0.0]: https://git.dev.egbt.com/egbt/secrets/releases/tag/v0.1.0.0

CLAUDE.md

@@ -138,31 +138,43 @@ Key design decisions (all driven by /autoplan review):
 
 ## Deploy Configuration
 
-- Platform: NONE (distributed via `git clone` from Codeberg)
+- Platform: NONE (distributed via `git clone` from the private Forgejo at `git.dev.egbt.com`)
 - Production URL: N/A (no live service)
 - Release model: merge to `main` is the release. Optionally tagged with `v<X.Y.Z.W>`.
 - Verification after merge: a fresh `git clone` should produce a working `secrets which` against an isolated `$HOME`. No canary URL.
 - Staging: none.
 - Rollback: revert the merge commit on `main` (and delete the tag) to roll back.
 
-## Codeberg operations
+## Forge operations (self-hosted Forgejo)
 
-The remote is Codeberg (Forgejo) — `gh`/`glab` do NOT work here. Use `tea`
-(login name: `codeberg`, user `egbt`) for forge operations when a skill's
+The remote is a private Forgejo instance at `https://git.dev.egbt.com`
+(migrated off Codeberg 2026-09-08). `gh`/`glab` do NOT work here. Use `tea`
+(login name: `egbt`, user `brian`) for forge operations when a skill's
 platform detection comes up "unknown":
 
-**Always pass `--login codeberg --repo egbt/secrets` explicitly.** `tea`'s
-repo autodetection fails here ("remote repository required"), and this machine
-also has an `egbt` login pointing at a *different* forge
-(`https://git.dev.egbt.com`) that `tea` will silently fall back to in
+**Always pass `--login egbt --repo egbt/secrets` explicitly.** `tea`'s repo
+autodetection fails here ("remote repository required"), and this machine also
+has a leftover `codeberg` login pointing at the *old* forge
+(`https://codeberg.org`) that `tea` will silently fall back to in
 non-interactive mode — which would target the wrong server. Confirm with
 `tea logins list` if a command errors.
 
-- PRs: `tea pr create --login codeberg --repo egbt/secrets --base main --head <branch> --title ... --description ...` / `tea pr merge <index> --login codeberg --repo egbt/secrets`
-- Releases: `tea releases create --login codeberg --repo egbt/secrets --tag v<X.Y.Z.W> --title "v<X.Y.Z.W> — <YYYY-MM-DD>" --note ...`
+- PRs: `tea pr create --login egbt --repo egbt/secrets --base main --head <branch> --title ... --description ...` / `tea pr merge <index> --login egbt --repo egbt/secrets`
+- Releases: `tea releases create --login egbt --repo egbt/secrets --tag v<X.Y.Z.W> --title "v<X.Y.Z.W> — <YYYY-MM-DD>" --note ...`
   (convention: one release per tag, title `v<X.Y.Z.W> — <date>`)
-- Issues/status: `tea issues --login codeberg --repo egbt/secrets`, `tea pr list --login codeberg --repo egbt/secrets`
-- No CI on this repo: the bats suite run locally is the merge gate.
+- Issues/status: `tea issues --login egbt --repo egbt/secrets`, `tea pr list --login egbt --repo egbt/secrets`
+- **SSH is on port 2222**, not 22 (port 22 is the host's own sshd). Clone/remote
+  URLs must be `ssh://git@git.dev.egbt.com:2222/egbt/secrets.git`. A bare
+  `git@git.dev.egbt.com:egbt/secrets.git` will fail with "Permission denied
+  (publickey)" because it hits the wrong daemon.
+- The host resolves to a Tailscale address — the forge is reachable only on the
+  VPN. Off-net, push/pull/`tea` all fail to connect; that is expected, not a
+  credentials problem.
+- `FORGEJO_URL` and `FORGEJO_TOKEN` (API token for user `brian`) live in
+  `~/.zshenv` for direct API calls.
+- CI: the instance has an Actions runner available, but no workflow is
+  configured for this repo yet. The bats suite run locally is still the merge
+  gate.
 
 ## Environment variable
 

README.md

@@ -69,7 +69,7 @@ two commands to finish setup. It never edits your shell config and never runs
 sudo — it prints the commands so you stay in control.
 
 ```bash
-git clone https://codeberg.org/egbt/secrets.git ~/dev/secrets
+git clone https://git.dev.egbt.com/egbt/secrets.git ~/dev/secrets
 cd ~/dev/secrets
 ./install.sh
 ```
@@ -82,7 +82,7 @@ this machine with one of the two flows below.
 
 ```bash
 # 1. Create a PRIVATE repo for your encrypted secrets (github.com/new or a
-#    Codeberg/GitLab private repo). It holds only ciphertext — never your key.
+#    GitLab/Forgejo private repo). It holds only ciphertext — never your key.
 #    Then wire it up and push the store in one command:
 secrets init --remote git@github.com:<you>/my-secrets.git
 
@@ -108,7 +108,7 @@ On a second machine, a desktop, or a teammate's laptop:
 
 ```bash
 # 1. Clone the tool and run the bootstrap (as in Setup above)
-git clone https://codeberg.org/egbt/secrets.git ~/dev/secrets
+git clone https://git.dev.egbt.com/egbt/secrets.git ~/dev/secrets
 cd ~/dev/secrets && ./install.sh   # add the printed PATH line to your shell config
 
 # 2. Get key.txt onto this machine (the one manual, out-of-band step):