REUSE-WP-0019-T01: forge host abstraction + URL migration inventory

reuse_surface/forge_host.py: parse/derive/rewrite raw index URLs across
Gitea and Forgejo (handles both the legacy /raw/<branch>/... form and the
canonical /raw/branch/<branch>/... form both forges serve without a 303
redirect). migrate_source_host() verifies the new URL resolves via HTTP
HEAD before writing -- refuses to point a repo at a host it hasn't
actually migrated to.

New CLI: reuse-surface federation migrate-host --repo <slug> --to
<base-url> [--from <check>] [--dry-run] [--no-verify] [--update-hub].

Inventory: cross-referenced sources.yaml against each repo's actual git
origin. 11/61 repos already on Forgejo; found 2 with stale sources.yaml
entries (activity-core, state-hub) despite having migrated. Fixed for
real: local sources.yaml + production hub registration (hub update),
verified against GET /v1/federated post-migration. config-atlas's
WP-0017-T06 303 confirmed NOT a host-transition symptom (already diagnosed
there as something else).

Also fixed two host-agnostic gaps found while inventorying:
registry_update.py and maintain_llm.py only recognized .gitea/workflows/,
missing repos already on .forgejo/workflows/. Fixed a stale copy-paste
example (state-hub's now-wrong old URL) in docs/RegistryFederation.md, and
a pre-existing unrelated port typo (8088 vs the real llm-connect default
8080) in tools/README.md and registry/README.md.

17 new pytest cases (tests/test_forge_host.py), 106 total pass.
Recomposed federated.yaml post-migration: still 61 capabilities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

reuse_surface/registry_update.py

@@ -19,7 +19,11 @@ from reuse_surface.registry import (
 )
 
 # Safe to apply without interactive review (see patches.SAFE_DETERMINISTIC_KINDS).
-SAFE_EVIDENCE_PREFIXES = ("tests/", ".gitea/workflows/")
+# Both forge CI workflow paths are recognized during the Gitea->Forgejo
+# transition (REUSE-WP-0019-T01) -- sibling repos migrate independently, so
+# either path is valid CI evidence depending on a given repo's progress.
+CI_WORKFLOW_PREFIXES = (".gitea/workflows/", ".forgejo/workflows/")
+SAFE_EVIDENCE_PREFIXES = ("tests/", *CI_WORKFLOW_PREFIXES)
 
 
 def git_changed_files(repo_root: Path, since_ref: str) -> list[str]:
@@ -194,7 +198,7 @@ def _collect_changed_file_suggestions(
                     "apply_patch": {"field": "evidence.tests", "append": changed},
                 }
             )
-        if changed.startswith(".gitea/workflows/") and changed.endswith((".yml", ".yaml")):
+        if changed.startswith(CI_WORKFLOW_PREFIXES) and changed.endswith((".yml", ".yaml")):
             field = "evidence.tests" if "test" in changed.lower() else "evidence.documentation"
             existing = evidence_tests if field == "evidence.tests" else evidence_docs
             if changed not in existing: