fix(#1320): placeholder-ize private-network topology, drop raw-curl force-merge recipe

Implements the rev-security-01 verdict on #1320 (comment 23282):

Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos
section shipped a working recipe for both failure modes the estate removes
identity that is not the actor's (a legacy shared credential path,
~/.config/mosaic/credentials/gitea.env, which no longer exists in the
credential system) and a quality gate routed around (raw curl +
force_merge:true, no queue guard, no head pin). Replaced with wrapper-only
merge guidance: protection blocks are signals to fix, not to bypass.

Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one
more than the verdict's five — the original scan missed guides/):
- skills/mosaic-portainer: Portainer URL, Docker host
- skills/mosaic-gitea: SSH resolution target
- skills/mosaic-deploy: Docker node, stack-name map (now generic example
  shape; estate mappings belong in skills-local overrides, which link with
  precedence)
- tools/coolify/README: base URL
- guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the
  RFC 5737 documentation range (192.0.2.5), the unambiguous example form

Left as-is per the verdict's split: estate DNS endpoints (e.g.
git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples.

Rescan of the whole shipped framework tree for RFC1918, estate hosts, and
stack-name patterns: zero remaining hits. The gate defect itself is filed
separately as #1321 (cross-referenced on #1320, comment 23285).

packages/mosaic/framework/skills/mosaic-portainer/SKILL.md

@@ -56,7 +56,7 @@ source ~/.config/mosaic/tools/_lib/credentials.sh && load_credentials portainer
 
 ## Notes
 
-- Portainer URL: `https://10.1.1.43:9443`
-- Primary Docker host: `w-docker0` (10.1.1.45) managed via Portainer agent
+- Portainer URL: `https://portainer.example.internal:9443`
+- Primary Docker host: `node-01`, managed via Portainer agent
 - Docker Swarm image updates: `stack-redeploy.sh -p` does NOT guarantee new image pull if digest is pinned; SSH to node and `docker pull` first if needed
 - Credentials: `load_credentials portainer` (framework credentials store)