REUSE-WP-0019-T01: forge host abstraction + URL migration inventory

reuse_surface/forge_host.py: parse/derive/rewrite raw index URLs across
Gitea and Forgejo (handles both the legacy /raw/<branch>/... form and the
canonical /raw/branch/<branch>/... form both forges serve without a 303
redirect). migrate_source_host() verifies the new URL resolves via HTTP
HEAD before writing -- refuses to point a repo at a host it hasn't
actually migrated to.

New CLI: reuse-surface federation migrate-host --repo <slug> --to
<base-url> [--from <check>] [--dry-run] [--no-verify] [--update-hub].

Inventory: cross-referenced sources.yaml against each repo's actual git
origin. 11/61 repos already on Forgejo; found 2 with stale sources.yaml
entries (activity-core, state-hub) despite having migrated. Fixed for
real: local sources.yaml + production hub registration (hub update),
verified against GET /v1/federated post-migration. config-atlas's
WP-0017-T06 303 confirmed NOT a host-transition symptom (already diagnosed
there as something else).

Also fixed two host-agnostic gaps found while inventorying:
registry_update.py and maintain_llm.py only recognized .gitea/workflows/,
missing repos already on .forgejo/workflows/. Fixed a stale copy-paste
example (state-hub's now-wrong old URL) in docs/RegistryFederation.md, and
a pre-existing unrelated port typo (8088 vs the real llm-connect default
8080) in tools/README.md and registry/README.md.

17 new pytest cases (tests/test_forge_host.py), 106 total pass.
Recomposed federated.yaml post-migration: still 61 capabilities.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md

@@ -62,21 +62,52 @@ refresh* and moves reliability evidence beyond structural.
 
 ```task
 id: REUSE-WP-0019-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4a187b56-bff9-4097-abd0-b423e7bf9442"
 ```
 
-- Inventory every hardcoded `gitea.coulomb.social` / `.gitea/` reference:
-  `sources.yaml` (60 raw URLs), hub registrations, establish/publish-check
-  defaults, docs, templates, CI workflows
-- Introduce `REUSE_SURFACE_FORGE_BASE_URL` (env + hub config); derive raw
-  index URLs from `{base}/{org}/{repo}/raw/{branch}/registry/indexes/capabilities.yaml`
-- Migration command: `reuse-surface federation migrate-host --from <old> --to <new>`
-  rewriting sources.yaml + hub registrations via the hub API
-- Check whether the config-atlas 303 (WP-0017-T06) is a symptom of the host
-  transition; coordinate findings
-- Tests: URL derivation, migrate-host dry-run
+**Inventory findings (2026-07-07):** cross-referenced `sources.yaml` (61
+entries) against each repo's actual git `origin` remote. Result: 11 repos
+already migrated their remote to Forgejo; 50 still on Gitea (correctly, no
+action needed). Of the 11 Forgejo-origin repos, 9 already had correct
+`sources.yaml` entries (from WP-0017 drafting/registration); **2 were
+stale** — `activity-core` and `state-hub` — still pointing at their old
+Gitea raw URL despite having migrated. This was real, live debt, not a
+hypothetical: both were confirmed reachable on Forgejo (HTTP 200) before
+being migrated for real, in both `sources.yaml` and the production hub
+registration (`hub update --url`). Verified post-migration against
+`GET /v1/federated` — both now show `forgejo.coulomb.social`.
+
+`config-atlas`'s WP-0017-T06 303 was **not** a host-transition symptom —
+already diagnosed there as (a) a redirect the current code already follows
+fine, and (b) a hub-registration gap unrelated to host. No new finding here.
+
+Implemented:
+
+- `reuse_surface/forge_host.py`: `parse_raw_url`/`derive_raw_url` (handles
+  both the legacy `/raw/<branch>/...` form and the canonical
+  `/raw/branch/<branch>/...` form both forges serve without a 303
+  redirect), `rewrite_url_host`, `forge_base_url` (reads
+  `REUSE_SURFACE_FORGE_BASE_URL`, no hard default since migration is
+  opt-in per repo), `migrate_source_host` (verifies the new URL resolves
+  via HTTP HEAD **before** writing — refuses to point a repo at a host it
+  hasn't actually migrated to)
+- CLI: `reuse-surface federation migrate-host --repo <slug> [--repo ...]
+  --to <base-url> [--from <sanity-check>] [--dry-run] [--no-verify]
+  [--update-hub]` — used for real on `activity-core`/`state-hub`
+- Fixed two host-agnostic code gaps found while inventorying:
+  `registry_update.py`'s `SAFE_EVIDENCE_PREFIXES` and `maintain_llm.py`'s
+  git-diff pathspec only recognized `.gitea/workflows/`, missing repos
+  already on `.forgejo/workflows/` — both now recognize either
+- Fixed stale copy-paste examples in `docs/RegistryFederation.md`
+  (state-hub's old Gitea URL, now genuinely wrong post-migration) and a
+  pre-existing, unrelated port typo (`8088` vs the real llm-connect
+  default `8080`) in `tools/README.md`/`registry/README.md`, discovered
+  and confirmed live during REUSE-WP-0018-T03
+- 17 new pytest cases (`tests/test_forge_host.py`); 106 total pass
+- Recomposed `federated.yaml` post-migration: still 61 capabilities, no
+  loss
 
 ## Hub Recompose Endpoint And Webhook Receiver