Record T02 package scope: Option C (OCI, npm, generic)

Operator decided multi-ecosystem registry with npm as a launch requirement;
additional types follow inventory evidence. Update SMTP row to T06-done state.

docs/forgejo-production-decisions.md

@@ -13,8 +13,8 @@ Operator input: 2026-07-03
 | 2b | Deployment pattern | `gitea-charts/gitea` **12.5.0** Helm + Forgejo image; CNPG `forgejo-db` in `railiance-platform`; Makefile in `railiance-apps` | **decided** | Chart 12.6+ requires Gitea 1.26 `config edit-ini` (incompatible with Forgejo 11); see `railiance-apps/docs/forgejo-on-railiance01.md` |
 | 2c | Live deploy | Forgejo pod + ingress + TLS on railiance01 | **done** (2026-07-03) | `make forgejo-smoke` → HTTP 200 + OCI `/v2/` 401 challenge; cert `forgejo-tls` Ready |
 | 3 | Gitea during transition | `gitea.coulomb.social` on coulombcore remains canonical **until** Forgejo restore/migration drills pass; then read-only mirror | unchanged | Per `RAIL-HO-WP-0005` safety contract |
-| 4 | SMTP / password reset | **IONOS** SMTP; sender `forgejo@coulomb.social`; mailer deployed on railiance01 | **done** (2026-07-07) | `railiance-apps` Helm rev 5; T06 password-reset test still open — see § SMTP below |
-| 5 | Package registry scope | TBD (container images first assumed) | open | — |
+| 4 | SMTP / password reset | **IONOS** SMTP; sender `forgejo@coulomb.social`; OpenBao/ESO mailer on railiance01 | **done** (2026-07-08) | `smtp.ionos.de:587` + `smtp+starttls`; T06 verified |
+| 5 | Package registry scope | **Multi-ecosystem (Option C):** OCI + **npm** + generic; PyPI/Go/Maven/Helm as inventory proves need | **decided** (2026-07-08) | OCI live; npm is launch requirement — see § Package scope |
 | 6 | Actions runner model | **In-cluster** on railiance01: `forgejo-runner` Deployment + DinD (`railiance01-build-01`) | **done** (2026-07-03) | Runner 2/2 Ready; coulombcore host runner disabled; `image-build` probe pushed OCI image via org secrets |
 | 7 | Backup target + retention | TBD | open | — |
 | 8 | Cutover mode | TBD (staged per-repo vs freeze-all) | open | — |
@@ -52,8 +52,8 @@ remains canonical for git remotes until migration drills pass.
 - Runners and image-build CI are proven; first repo migration pilot
   (`glas-harness`) documents git/SSH/CI routing in
   `docs/forgejo-repo-migration-pilot-glas-harness.md`.
-- Remaining blockers for production cutover: SMTP **mailbox + T06 test** (provider
-  decided: IONOS), backup, cutover mode, and production repo migration
+- Remaining blockers for production cutover: backup target (T02), cutover mode
+  confirmation (T02), npm/package hardening (T07), and production repo migration
   (`RAIL-HO-WP-0005-T11`).
 
 ## SMTP decision (IONOS) — 2026-07-07
@@ -85,12 +85,42 @@ via IONOS; mailboxes provisioned in IONOS control panel).
    confirm delivery and link works.
 
 **Implementation:** `railiance-apps/docs/forgejo-on-railiance01.md` (SMTP section).
+Password in OpenBao `platform/workloads/forgejo/forgejo-mailer` (field `PASSWD`).
+
+## Package scope decision (Option C) — 2026-07-08
+
+**Operator choice:** Multi-ecosystem registry — not OCI-only at launch.
+
+| Phase | Package types | Status |
+| --- | --- | --- |
+| **Now (proven)** | OCI container images | Live — tier 0–3 CI (`container-build-push` templates) |
+| **Launch requirement** | **npm** | Decide → implement in T07 (auth, publish/pull docs, CI template) |
+| **In scope** | Generic (release tarballs/binaries) | Enable with retention policy |
+| **As needed** | PyPI, Go, Maven, Helm | Add per repo only after T01 inventory shows Gitea package data or an explicit consumer need |
+
+**Rationale:** Railiance needs npm publishing; other ecosystems follow evidence, not
+a big-bang enable-everything default.
+
+**Implications:**
+
+- T07 expands beyond OCI smoke: npm publish/pull runbook, org/repo token policy,
+  retention/cleanup for non-OCI blobs.
+- T09 backups must include **all enabled package types** under `/data/packages`.
+- T01 authenticated Gitea inventory should classify existing npm (and other) package
+  data before cutover waves.
+
+**Forgejo endpoints (post-cutover):**
+
+| Type | URL pattern |
+| --- | --- |
+| OCI | `forgejo.coulomb.social/coulomb/<image>` |
+| npm | `https://forgejo.coulomb.social/api/packages/coulomb/npm/` (configure scope in T07) |
+| Generic | per-repo generic package API |
 
 ## Open decisions (need operator input)
 
-1. ~~SMTP provider~~ — **done: IONOS** (`forgejo@coulomb.social` deployed); remaining:
-   T06 password-reset delivery test
-2. Package types beyond OCI at launch (npm, PyPI, Helm, …)
-3. Actions runner: in-cluster ephemeral vs long-lived pod vs host runner
+1. ~~SMTP provider~~ — **done** (IONOS + T06 verified 2026-07-08)
+2. ~~Package types~~ — **done: Option C** (OCI + npm + generic; others as needed)
+3. ~~Actions runner~~ — **done** (in-cluster, ADR-004)
 4. Backup destination and restore cadence
 5. Cutover: staged project-by-project vs single freeze window