merge: bring the open-source readiness work onto the phase-13 branch

Merges gitea-ai/main (65 commits) into the phase-13 branch (419) so one
build carries both lines — the AIUI/assistant/container work and the
open-source readiness work (licensing, the marketplace DID signature layer,
the registry domain migration, the secrets and infrastructure scrub).

Every Rust file auto-merged. The container fixes from this branch and main's
registry-domain migration and node-name genericisation coexist without
manual intervention.

Conflict resolution — all of them were modify/delete, and all were resolved
in main's favour deliberately:

`.planning/**`, `scripts/deploy-to-target.sh` and `scripts/setup-aiui-server.sh`
were deleted by main's `6ba05996` ("security: remove all infrastructure and
internal process material from the repo") and added to .gitignore there.
Keeping this branch's copies would have re-committed internal process and
infrastructure material into a repo being prepared for publication, silently
undoing that cleanup. Resolved with `git rm --cached`, so every file remains
on disk locally and in this branch's history — it is untracked, not lost.
The remaining .planning files this branch added after the merge base were
untracked the same way, so the result is consistent rather than half-tracked.

Container suite 221/221 on the merged tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/first-boot-containers.sh

@@ -4,12 +4,12 @@
 # Creates core containers so My Apps works out of the box after ISO install
 # Runs after archipelago-load-images.service and archipelago-setup-tor.service
 #
-# Based on scripts/deploy-to-target.sh (--live) container logic - do not diverge.
+# Container logic mirrors the deploy path - do not diverge.
 # No set -e: each section continues even if one fails (idempotent, best-effort).
 #
 # Image versions: sourced from /opt/archipelago/image-versions.sh (single source of truth).
 # All container image references use the $*_IMAGE variables defined there.
-# Images pull from the Archipelago app registry (146.59.87.168:3000/lfg2025/).
+# Images pull from the Archipelago app registry (source.archipelago-foundation.org/lfg2025/).
 #
 # --- PLANNED REFACTOR (post-beta) ---
 # This script is ~995 lines and should be split into a modular library.