RAILIANCE-WP-0002 T03 done: image pushed to Gitea registry

Pushed gitea.coulomb.social/coulomb/vergabe-teilnahme:{483a4df,latest}
using the GITEA_API_TOKEN env (token owner: tegwick).

Image digest:
  sha256:e9bbceb35b0239c835d339295a0ae1d2d8b6d08c02a7b4e992c0ecd37de86d7a

Cluster-side pull verified — pod reached Running in ~7s with no
imagePullSecret; the package is public by default, so T05's Helm
release will not need pull credentials wiring.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workplans/railiance-apps-WP-0002-vergabe-teilnahme-on-railiance01.md

@@ -277,7 +277,7 @@ resolves cleanly outside Docker.
 
 ```task
 id: RAILIANCE-WP-0002-T03
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d0f8db8c-fad9-4e0b-a404-9e3a04cffb05"
 ```
@@ -300,6 +300,17 @@ exact image reference and digest used for the first deployment.
 **Done when:** the image is fetchable from a disposable Kubernetes pod
 on the cluster.
 
+**Done (2026-05-19):**
+
+- Pushed `gitea.coulomb.social/coulomb/vergabe-teilnahme:483a4df`
+  and `:latest` from the `vergabe-teilnahme:t02-smoke` build.
+- Image digest: `sha256:e9bbceb35b0239c835d339295a0ae1d2d8b6d08c02a7b4e992c0ecd37de86d7a`.
+- Token owner: `tegwick` (Bernd Worsch). Push namespace: `coulomb` org.
+- Cluster-side pull verified via `kubectl run vt-pull-test` —
+  pod reached `Running` in ~7s with no `imagePullSecret`. **Package
+  is public by default**; T05 does not need to wire an imagePullSecret
+  unless the package is later made private in the Gitea web UI.
+
 ---
 
 ### T04 — Provision PostgreSQL role and database