RAIL-AP-WP-0001 T04 done: state-hub image pushed and cluster-pullable

Used the GITEA_API_TOKEN env (token owner: tegwick) to log in to
gitea.coulomb.social and push state-hub:local as
gitea.coulomb.social/coulomb/state-hub:{6186a99,latest}.

Image digest:
  sha256:039d29654ccb3754c6ecdbe497c6364bbd8452edcdcb7fa937dd9debf5b734ff

Verified cluster-side pull via kubectl run; pod reached Running in
~5s with no imagePullSecret. The Gitea container registry is now
proven end-to-end for State Hub deployment.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workplans/RAIL-AP-WP-0001-gitea-container-registry.md

@@ -182,7 +182,7 @@ cluster access paths.
 
 ```task
 id: RAIL-AP-WP-0001-T04
-status: blocked
+status: done
 priority: high
 state_hub_task_id: "5ffd7515-384b-4a11-9b5e-141197d1b985"
 ```
@@ -206,6 +206,22 @@ package is private.
 **Done when:** the State Hub image can be pushed and pulled by both the
 operator workstation and the Railiance cluster runtime.
 
+**Done (2026-05-19):**
+
+- Authenticated with `docker login gitea.coulomb.social -u tegwick`
+  using the `GITEA_API_TOKEN` env (token owned by user `tegwick`,
+  Bernd Worsch).
+- Pushed `gitea.coulomb.social/coulomb/state-hub:6186a99` and
+  `:latest` from the locally built `state-hub:local` image.
+- Image digest: `sha256:039d29654ccb3754c6ecdbe497c6364bbd8452edcdcb7fa937dd9debf5b734ff`.
+- Cluster-side pull verified via `kubectl run sh-pull-test
+  --image=gitea.coulomb.social/coulomb/state-hub:6186a99`: pod
+  reached `Running` in ~5s, image size 106 MB, no `imagePullSecret`
+  required (`coulomb` org packages are public by default).
+- The same token + workflow was independently exercised pushing
+  `vergabe-teilnahme:483a4df` under `RAILIANCE-WP-0002-T03` —
+  confirming the registry is fully usable for any S5 workload.
+
 ---
 
 ### T05 — Document registry handoff for State Hub deployment