Retire shorashim.ch; Gitea brand becomes Bikoret

- service.yaml: the shorashim.ch host rule is gone from the Ingress;
  the no-host catch-all stays for http://185.19.28.170
- gitea-public-patch.yaml: APP_NAME "Shorashim" → "Bikoret" (title and
  brand on every Gitea page)
- shorashim-ch-takedown.sh: the operator's apply (ingress, orphan
  mcp.shorashim.ch TLS secret, Gitea patch + rollout) with verification
- KOHEN.md, AGENTS.md: examples and the endpoint table use bikoret.ch

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

KOHEN.md

@@ -481,11 +481,11 @@ If any day failed: record what broke, fix the cause, restart from Day 1.
 ```bash
 # 1. Write today's manna provision (same format as Day 4, new date)
 # 2. Health check
-curl https://shorashim.ch/kodesh/health | jq .
+curl https://bikoret.ch/kodesh/health | jq .
 # 3. Halt status
-curl https://shorashim.ch/kodesh/status | jq .halt_status
+curl https://bikoret.ch/kodesh/status | jq .halt_status
 # 4. Refuge list
-curl https://shorashim.ch/kodesh/status | jq '.refuge_components'
+curl https://bikoret.ch/kodesh/status | jq '.refuge_components'
 ```
 
 ### Issuing a key — *Mishmeret HaSha'ar*
@@ -750,7 +750,7 @@ The halt monitor detected one of three cardinal sins:
 
 ```bash
 # Inspect the halt
-curl https://shorashim.ch/kodesh/status | jq .halt_status
+curl https://bikoret.ch/kodesh/status | jq .halt_status
 kubectl logs -n shorashim deploy/bikoret -c vav-pipeline | grep HALT
 
 # Investigate. Fix the root cause. Then resolve via the operator API.