Registry (cr.os.mieweb.org) + CI details needed by mieweb/cloud container image pipeline (mieweb/cloud#6)

[horner]

Context

mieweb/cloud now ships container-image plumbing for its mieweb target (the mieweb images … / mieweb registry … CLI, merged in mieweb/cloud#3). It assumes this cluster provides an OCI container registry (currently Harbor) and Forgejo Actions as the CI that builds and pushes images. The remaining work on their side is blocked on details from here.

Tracking issue on the cloud side, with the full checklist: mieweb/cloud#6.

What cloud needs from this repo

• Registry hostname — cloud uses the implementation-neutral name cr.os.mieweb.org so the product behind it (Harbor today) can be swapped without touching app configs; please provision that DNS name (CNAME to the real Harbor host is fine) and confirm CA/TLS posture (public cert vs. private CA).
• Confirm/adjust registry conventions: project per app (e.g. cloud-apps), repo = container class name lowercased, tag = git short SHA + latest.
• Robot-account conventions (robot$<project>+<name>) and how the auth file reaches CI runners and developers.
• Whether CI runners (Forgejo Actions today) ship buildah + skopeo, or workflows must install them (reference workflow: packages/test-app/ci-images.example.yml in cloud).
• Early thoughts on the container runtime host for cloud's Milestone 4 (Podman over SSH, k8s shim, or an artipod manager — see Service realizer: image + port + idle timeout → fetch handler (for Cloudflare-style containers in mieweb/cloud) artipod#56), so any config surface can be reserved now.

Please post answers on mieweb/cloud#6 (or here and we'll mirror them).