fix(docs-deploy): one registry — ghcr.io/hanzoai/docs (CR pull == CI push)

The docs App CR + pods pull ghcr.io/hanzoai/docs (public), but deploy-docs.yml
built+pushed+patched ghcr.io/hanzo-docs/docs (private) → every operator deploy
ErrImagePull'd (kept alive only by a manual crane-copy). Converge both on the
canonical public ghcr.io/hanzoai/docs per the Hanzo registry rule: CI push target
now equals the CR pull source. Immutable SHA tag only (drop floating :latest).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/deploy-docs.yml

@@ -89,7 +89,7 @@ jobs:
       # docs.hanzo.ai is served by the in-cluster docs-landing Deployment behind
       # hanzoai/ingress — no Cloudflare. Built here on the self-hosted runner (docker
       # is present; "no GitHub builders" = no GitHub-HOSTED runners, self-hosted is ok).
-      - name: Build + push native docs image (ghcr.io/hanzo-docs/docs)
+      - name: Build + push native docs image (ghcr.io/hanzoai/docs)
         run: |
           cat > Dockerfile.serve <<'EOF'
           FROM ghcr.io/hanzoai/static:0.4.1
@@ -98,9 +98,11 @@ jobs:
           ENTRYPOINT ["/static", "-port", "3000", "-root", "/public"]
           EOF
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
-          docker build -f Dockerfile.serve -t ghcr.io/hanzo-docs/docs:latest -t "ghcr.io/hanzo-docs/docs:${GITHUB_SHA}" .
-          docker push ghcr.io/hanzo-docs/docs:latest
-          docker push "ghcr.io/hanzo-docs/docs:${GITHUB_SHA}"
+          # ONE registry: ghcr.io/hanzoai/docs (public) — the SAME target the
+          # CR pulls and the platform-native /v1/runner build pushes. Immutable
+          # SHA tag only; never a floating :latest in the cluster.
+          docker build -f Dockerfile.serve -t "ghcr.io/hanzoai/docs:${GITHUB_SHA}" .
+          docker push "ghcr.io/hanzoai/docs:${GITHUB_SHA}"
 
       # DEPLOY (native, operator-driven). Declare the freshly-built immutable SHA
       # tag to the docs App CR; hanzo-operator reconciles the rollout. CI never

k8s/docs-app.yaml

@@ -27,8 +27,13 @@ spec:
   partOf: platform
   replicas: 2
   image:
-    repository: ghcr.io/hanzo-docs/docs
-    tag: 0ab3ce4821309aeab98865f726bc071c7170305e
+    # ONE registry for docs: ghcr.io/hanzoai/docs (public). This is where the
+    # platform-native fabric (POST /v1/runner → buildkit Job, see root Dockerfile)
+    # pushes AND where deploy-docs.yml pushes — CR pull source == CI push target,
+    # per the "Hanzo → ghcr.io/hanzoai/*" registry rule. NEVER ghcr.io/hanzo-docs/*
+    # (a private package the pods' ghcr-secret can't pull → ErrImagePull).
+    repository: ghcr.io/hanzoai/docs
+    tag: sha-40e315ec0
     pullPolicy: IfNotPresent
   imagePullSecrets:
     - name: ghcr-secret