fix(#1320): placeholder-ize private-network topology, drop raw-curl force-merge recipe (#1322)

packages/mosaic/framework/skills/mosaic-deploy/SKILL.md

@@ -42,14 +42,12 @@ cd ~/src/<repo>
 ~/.config/mosaic/tools/git/pr-merge.sh -n <pr#> -d
 ```
 
-For branch-protected repos (force merge):
-
-```bash
-GITEA_TOKEN=$(cat ~/.config/mosaic/credentials/gitea.env | grep TOKEN | cut -d= -f2)
-curl -X POST "https://git.mosaicstack.dev/api/v1/repos/<org>/<repo>/pulls/<pr#>/merge" \
-  -H "Authorization: token $GITEA_TOKEN" -H "Content-Type: application/json" \
-  -d '{"Do":"squash","force_merge":true}'
-```
+Always merge through `pr-merge.sh`: it runs the CI queue guard first and pins
+the merge to the reviewed head. If branch protection blocks the merge, that is
+a gate telling you something — a failing check, a moved head, or a missing
+review. Fix the cause; never route around it with a raw API call, a shared
+credential, or `force_merge`. Exceptional cases go to the operator or the
+coordinating seat, still merged through the wrapper.
 
 ### Step 4: Redeploy Portainer stack
 
@@ -67,16 +65,18 @@ Check deployment:
 
 ## Stack Name Map
 
-| Project      | Stack Name     |
-| ------------ | -------------- |
-| mosaic-stack | `mosaic-stack` |
-| sage-phr     | `sage-phr`     |
-| openbrain    | `openbrain`    |
-| firefly      | `firefly`      |
+Maintain your estate's project → stack-name mapping in a skills-local override of
+this skill (local copies take precedence over the shipped canonical one). Example
+shape:
+
+| Project      | Stack Name        |
+| ------------ | ----------------- |
+| `sample-app` | `sample-app`      |
+| `sample-api` | `sample-api-prod` |
 
 ## Notes
 
 - Workers open PRs but **never merge** — orchestrator or Merge Guard handles step 3+
-- Docker Swarm image pinning: if `-p` doesn't pull a new image, SSH to `w-docker0` (10.1.1.45) and run `docker pull <image>` manually, then redeploy
+- Docker Swarm image pinning: if `-p` doesn't pull a new image, SSH to the Docker node (e.g. `node-01`) and run `docker pull <image>` manually, then redeploy
 - Worktrees: all coding work in `~/src/<repo>-worktrees/<task-slug>`, never in main checkout
 - Always clean up worktree after push: `git worktree remove ~/src/<repo>-worktrees/<task-slug>`