housekeeping: the inventory a stranger reads first

From a reading of the gate's documents (2026-10-21):
- AGENTS.md: Steps 14 and 15 shown Pending while the Port and both
  sockets have carried live traffic since the gate was built → Done,
  with what carries them; "next build task" now points at the open
  items, the phase tables being complete.
- README.md: the repository tree omitted azazel_processor,
  kushya_generator, mesorah, src/tools and scripts → listed, each in a
  line.
- deploy/ARCHITECTURE.md: the judgment path holds no model, said in
  writing — the examination is Python patterns and Prolog rules, the
  judges consult that Prolog; kushya_generator (a fine-tuned model in
  this repo, not deployed, not wired) is an OFFERER whose output is
  examined, never a component the bedikah, the engine or a judge
  consults. The kohen is not the offerer. azazel_processor listed.
- The map: the repository is public; eleven files named the ingress
  NLB's literal address and five the kohen's kubeconfig path. Docs now
  use the domains (git.bikoret.ch, bikoret.ch) or "<NLB-IP>" with the
  kubectl query that answers it; the kubeconfig is "$KUBECONFIG" /
  "$HOME/.kube/<your-cluster>.yaml". gitea-public-apply.sh takes NLB
  from the environment. None of it was a secret; all of it was a map.
- OTP pin: checked, not changed — the segfault in the build log was a
  source-built OTP 26.2.1 on macOS; the image is hexpm's 26.2.1 with
  ERL_FLAGS +JMsingle.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/gitea-public-apply.sh

@@ -2,7 +2,7 @@
 # Move Gitea and its MCP server to public HTTPS on bikoret.ch and switch
 # the MCP server to MCP OAuth (2026-10-19). Run by the transmitter:
 #   ! bash ~/.local/bin/gitea-public-apply
-# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → 185.19.28.170.
+# Idempotent. Needs DNS first: git.bikoret.ch and mcp.bikoret.ch → <NLB-IP>.
 #
 # Rollback (static-token mode on mcp.shorashim.ch, as before 2026-10-19):
 #   kubectl -n temple-council set env deploy/gitea \
@@ -12,7 +12,7 @@
 set -euo pipefail
 REPO="${REPO:-$HOME/bikoret}"
 cd "$REPO"
-NLB=185.19.28.170
+NLB="${NLB:?set NLB to the ingress address: kubectl get svc -n ingress-nginx ingress-nginx-controller}"
 for h in git.bikoret.ch mcp.bikoret.ch; do
   ip=$(dig +short "$h" | tail -1 || true)
   if [ "$ip" != "$NLB" ]; then