docs(ri-050): session log part 2 — merge wave behind the live gate (#1275)

All kaniko image steps (publish.yml build-gateway/build-ci-base/build-*
and ci-image.yml build-ci-base) referenced from_secret: gitea_username /
gitea_password - which do not exist at repo level - while the repo
carries unused REGISTRY_USERNAME/REGISTRY_PASSWORD secrets. Result: every
image push fails at kaniko's push-permission check (measured: 2482 and
2488 build-gateway 'error checking push permissions'; the same auth gap
is documented in ci.yml's step-level pi install comment re ci-base).

Rewire all six references to the REGISTRY_* secrets that exist. If those
credentials are valid, next push pipelines go fully green behind the new
verify gate; if not, the failure moves to an explicit 401 - either way
the ambiguous permission error resolves into a known state.

.woodpecker/ci-image.yml

@@ -22,9 +22,9 @@ steps:
     image: gcr.io/kaniko-project/executor:debug
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}

.woodpecker/publish.yml

@@ -270,9 +270,9 @@ steps:
     when: *image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -306,9 +306,9 @@ steps:
     when: *main_image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}
@@ -333,9 +333,9 @@ steps:
     when: *main_image_build_when
     environment:
       REGISTRY_USER:
-        from_secret: gitea_username
+        from_secret: REGISTRY_USERNAME
       REGISTRY_PASS:
-        from_secret: gitea_password
+        from_secret: REGISTRY_PASSWORD
       CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}
       CI_COMMIT_TAG: ${CI_COMMIT_TAG}
       CI_COMMIT_SHA: ${CI_COMMIT_SHA}

docs/scratchpads/ri-050.md

@@ -240,3 +240,14 @@ and fargo. Protocol (both seats, every handoff):
   (comms/20260818T011932Z__from-jarvis__a9c02b.md). Not merging #1293/#1294 before my three
   clear fargo's review — order optimality beats speed; every pre-#1277 merge publishes ungated.
 - CI on the three rebased heads: pending at time of this entry.
+
+## topher session 2026-08-18 (overnight, part 2) — the floor lands behind the live gate
+
+- MERGED (all squash, head-pinned, reviews at pinned heads): #1278 (review 184 fred; forge fail-closed), #1293 (review 173; MACP), #1294 (review 174; PRD authority), #1300 (review 179; web freshness), #1305 (review 182; publish-gate negative controls, mutation-verified by me both directions before merge), #1306 (review 181; registry secret rewire). Plus earlier: #1276, #1277, #1304.
+- Push pipeline 2501 (post-merge-wave): verify GREEN -> build GREEN -> publish-next-npm GREEN. Only build-gateway red = registry credentials (documented, Jason action item posted as issue #1275 comment; REGISTRY_* secret values rejected at /v2/token with UNAUTHORIZED; my API token lacks package scope so no agent can substitute).
+- Registry root-cause chain: #1306 made the error legible (was ambiguous 'error checking push permissions' since >=2439, now explicit 401); the creds themselves are Jason's to rotate.
+- #1299 (forge docs) rebased onto post-#1278 next after mergeable=false (cherry-pick redo; TASKS conflict resolved by regenerating statuses from measured state: 0-001/1-001/1-002/2-001 done; 2-002/3-001/4-001/5-001 in-progress pending their docs rows catching the merges).
+- Evidence pack: docs/release-integrity/release-evidence.md (branch docs/ri-050-release-evidence) — exhibits 2486 (gate fail-closed blocking all publish steps), 2488 (first gated green npm), 2501 (gated green publish of the full floor). Opens as a PR when RI-3-002 lands.
+- Remaining: #1299 + #1302 reviews (docs), RI-3-002 dispatch after #1302 merges, RI-V-001 final, registry creds (Jason).
+
+— topher (recorded under the jarvis principal pending identity provisioning), 2026-08-18