docs(ri-050): registry credential fixed server-side; pack merge is the end-to-end proof (#1275)

docs/release-integrity/release-evidence.md

@@ -1,6 +1,6 @@
 # RI-050 Release Evidence Pack (alpha 0.0.50 release-integrity floor)
 
-> Status: **DRAFT — near complete**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Remaining for closure: one fully-green push pipeline (blocked only on the registry-credential item below) and final verification. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
+> Status: **DRAFT — final proof pending**. All five normative requirements (RI-N1..N5) merged to `next` behind the live gate. Registry credential fixed 2026-08-18 23:47Z (see infrastructure item below). Remaining for closure: one fully-green post-fix push pipeline — **this pack's own merge to `next` is that proof event**, its pipeline number recorded in the #1275 closure comment. Last updated 2026-08-18 by fargo (day-takeover orchestrator).
 > Card: RI-V-001. All sections marked ⏳ pending their card's merge. Normative source:
 > `docs/PRD.md` § Release Integrity Workstream (#1275).
 
@@ -56,6 +56,27 @@ than a minted token value, `/v2/token` 401s exactly as observed. npm publishes
 remained green in 2507; every publish step except the image push is gated and
 green.
 
+**Resolution 2026-08-18 23:47Z — FIXED on the Gitea server (jarvis, #1275
+comment 23239).** Root cause was neither scope nor a missing token:
+`REGISTRY_USERNAME` held `mosaic`, the **pre-rename org name**. Gitea's rename
+redirect covers API/web paths but not Basic-auth username lookup, and
+`mosaicstack` is an organization, which has no password — the pair could never
+authenticate. Fix: `REGISTRY_USERNAME`=`woodpecker` (the existing service
+account, Gitea user 41, already in `ci-publish`) and `REGISTRY_PASSWORD`= a
+newly minted `write:package`-only token (`gitea admin user generate-access-token`
+in the Gitea container; minting with a token is forbidden server-side). Events
+`[push, tag]` preserved. Verified **without a pipeline run**:
+`POST /v2/<pkg>/blobs/uploads/` opened then cancelled a session — **202** on
+all four kaniko destinations (gateway, appservice, web, ci-base), anonymous
+control **401**, wrong-owner control **401**. Not verified: stored-secret
+byte-intactness (Woodpecker never returns secret values). First post-fix push
+on `next` is the end-to-end proof; per the pack status line above, that is
+this PR's own merge pipeline. If `build-gateway` is still red with this
+credential proven good, the fault is in the step, not the secret — do not
+re-mint on that evidence. The earlier "Requires a package-scoped token
+(Jason)" expectation is superseded: the defect was a stale value from the org
+rename, not a scope grant Jason owed.
+
 ## Process record (audit trail)
 
 - Merges executed under the jarvis principal (topher seat; identity provisioning