The GitOps step relied on GITEOPS_REPO/GITEOPS_SSH_KEY secrets that were
never configured, and the registry login used a REGISTRY_HOSTPORT secret
that doesn't match this repo's actual registry setup. Switch to the
Forgejo registry directly and push the GitOps update over HTTPS with a
token, matching how other services in this org already deploy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>