REUSE-WP-0019-T01: forge host abstraction + URL migration inventory

reuse_surface/forge_host.py: parse/derive/rewrite raw index URLs across
Gitea and Forgejo (handles both the legacy /raw/<branch>/... form and the
canonical /raw/branch/<branch>/... form both forges serve without a 303
redirect). migrate_source_host() verifies the new URL resolves via HTTP
HEAD before writing -- refuses to point a repo at a host it hasn't
actually migrated to.

New CLI: reuse-surface federation migrate-host --repo <slug> --to
<base-url> [--from <check>] [--dry-run] [--no-verify] [--update-hub].

Inventory: cross-referenced sources.yaml against each repo's actual git
origin. 11/61 repos already on Forgejo; found 2 with stale sources.yaml
entries (activity-core, state-hub) despite having migrated. Fixed for
real: local sources.yaml + production hub registration (hub update),
verified against GET /v1/federated post-migration. config-atlas's
WP-0017-T06 303 confirmed NOT a host-transition symptom (already diagnosed
there as something else).

Also fixed two host-agnostic gaps found while inventorying:
registry_update.py and maintain_llm.py only recognized .gitea/workflows/,
missing repos already on .forgejo/workflows/. Fixed a stale copy-paste
example (state-hub's now-wrong old URL) in docs/RegistryFederation.md, and
a pre-existing unrelated port typo (8088 vs the real llm-connect default
8080) in tools/README.md and registry/README.md.

17 new pytest cases (tests/test_forge_host.py), 106 total pass.
Recomposed federated.yaml post-migration: still 61 capabilities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/RegistryFederation.md

@@ -94,13 +94,24 @@ returns **200** with valid YAML (not a redirect to login or HTML).
 
 Entry bodies remain in the source repo; the index is the federation surface.
 
-### Gitea raw URL shape
+### Raw URL shape (Gitea or Forgejo)
+
+The organization is mid-transition from Gitea to Forgejo (REUSE-WP-0019);
+sibling repos migrate their git remote independently, so both forms are
+valid depending on which host a given repo currently lives on. Prefer the
+branch-qualified form — both forges serve it directly with no redirect,
+unlike the shorter `/raw/<branch>/...` form which 303-redirects:
 
 ```text
-https://gitea.coulomb.social/coulomb/<repo>/raw/<branch>/registry/indexes/capabilities.yaml
+https://gitea.coulomb.social/coulomb/<repo>/raw/branch/<branch>/registry/indexes/capabilities.yaml
+https://forgejo.coulomb.social/coulomb/<repo>/raw/branch/<branch>/registry/indexes/capabilities.yaml
 ```
 
-Use `main` (or the repo's default branch). Verify before registration:
+Use `main` (or the repo's default branch). `reuse-surface federation
+migrate-host` rewrites a repo's registered URL from one host to the other
+once its remote has actually migrated (verifies reachability before
+writing — never blind-rewrites a repo that hasn't moved yet). Verify before
+registration:
 
 ```bash
 curl -fsSI "<raw-url>" | head -n1   # expect HTTP/2 200 or HTTP/1.1 200
@@ -132,17 +143,17 @@ reuse-surface establish --scaffold --domain helix_forge
 reuse-surface validate
 git push origin main
 reuse-surface establish --publish-check \
-  --raw-url https://gitea.coulomb.social/coulomb/state-hub/raw/main/registry/indexes/capabilities.yaml
+  --raw-url https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
 ```
 
 ### Ongoing maintenance (from sibling repo)
 
 ```bash
-export LLM_CONNECT_URL=http://127.0.0.1:8088   # optional
+export LLM_CONNECT_URL=http://127.0.0.1:8080   # optional
 reuse-surface maintain --all --from-git-since origin/main
 reuse-surface maintain --all --auto --no-llm    # CI / pre-commit
 reuse-surface maintain --publish \
-  --raw-url https://gitea.coulomb.social/coulomb/state-hub/raw/main/registry/indexes/capabilities.yaml \
+  --raw-url https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml \
   --all --auto --no-llm
 ```