M3 follow-up: coordinate registry (cr.os.mieweb.org) + CI details with opensource-server

[horner]

What

Close out Milestone 3 of container-plan.md: the one open item is coordination with opensource-server, whose standalone cluster hosts Harbor (registry) and Forgejo (CI).

Everything in this repo is done and merged (#3): mieweb images build|push|inspect|status, mieweb registry login|logout, the mieweb.jsonc registry block, registry naming conventions, and a Forgejo Actions sketch at packages/test-app/ci-images.example.yml. What remains is blocked on the cluster existing.

Needed from opensource-server

• Registry hostname for the mieweb target — the plan uses the implementation-neutral name cr.os.mieweb.org so the product (Harbor today) can be swapped without touching app configs; confirm DNS + CA/TLS expectations (public cert vs. private CA → does insecureSkipTlsVerify ever need to be true?)
• Project naming: plan assumes one project per app (e.g. cloud-apps), repo = container class name lowercased, tag = git short SHA + latest. Confirm or push back.
• Robot-account conventions (robot$<project>+<name>) and how the authFile is provisioned to CI and to devs.
• Whether CI runners (Forgejo Actions today) have buildah/skopeo (or should the example workflow install them).
• Anything about the eventual container runtime host (M4) worth reserving config for now — Podman over SSH vs. k8s shim vs. artipod manager (see mieweb/artipod#56).

Then, in this repo

• Run mieweb images push --target mieweb end-to-end against the real registry with a robot account; record the result in the plan.
• Update packages/cloud-os/mieweb.sample.jsonc and the cli README with the confirmed URL/conventions.
• Tick the last M3 box.

Cross-ref: opensource-server issue linked below once filed.

[horner]

Counterpart on the cluster side: mieweb/opensource-server#473