Add Forgejo tier-3 remote_url and sweep playbook

Document State Hub PATCH procedure, sweep implications, railiance01 host_paths,
state-hub image specifics, and rollback. Include batch patch helper; applied
tier-2.5 remote_url updates in hub DB.

tools/patch-forgejo-remote-urls.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Patch State Hub managed_repos.remote_url from gitea-remote to forgejo-remote.
+# Usage: patch-forgejo-remote-urls.sh slug [slug ...]
+#        patch-forgejo-remote-urls.sh --tier-25
+set -euo pipefail
+
+API_BASE="${API_BASE:-http://127.0.0.1:8000}"
+ORG="${FORGEJO_ORG:-coulomb}"
+
+TIER_25=(
+  railiance-enablement
+  railiance-infra
+  railiance-apps
+  railiance-platform
+  railiance-cluster
+  glas-harness
+  key-cape
+)
+
+if [[ "${1:-}" == "--tier-25" ]]; then
+  set -- "${TIER_25[@]}"
+fi
+
+if [[ $# -lt 1 ]]; then
+  echo "usage: $0 slug [slug ...] | --tier-25" >&2
+  exit 1
+fi
+
+for slug in "$@"; do
+  new_url="forgejo-remote:${ORG}/${slug}.git"
+  http=$(curl -sS -o /tmp/repo-get.json -w '%{http_code}' "${API_BASE}/repos/${slug}")
+  if [[ "${http}" == "404" ]]; then
+    echo "SKIP ${slug} (not registered in State Hub)"
+    continue
+  fi
+  if [[ "${http}" != "200" ]]; then
+    echo "FAIL ${slug} GET http=${http}" >&2
+    exit 1
+  fi
+  current=$(python3 -c "import json; print(json.load(open('/tmp/repo-get.json')).get('remote_url') or '')")
+  if [[ "${current}" == "${new_url}" ]]; then
+    echo "OK  ${slug} (unchanged)"
+    continue
+  fi
+  curl -fsS -X PATCH "${API_BASE}/repos/${slug}" \
+    -H "Content-Type: application/json" \
+    -d "{\"remote_url\": \"${new_url}\"}" >/dev/null
+  echo "PATCH ${slug}: ${current:-<empty>} -> ${new_url}"
+done