the place: bikoret.ch — Ingress hosts, TLS, and the .org redirect

bikoret.ch and www.bikoret.ch served with a Let's Encrypt certificate
through cert-manager (letsencrypt-prod, HTTP-01), ssl-redirect on;
bikoret.org and www redirect permanently to https://bikoret.ch; the
no-host catch-all stays; shorashim.ch still answers over plain HTTP
until its callers have moved. KOHEN Day 8 gives the order: A records,
wait for the name to resolve, then apply — never before. Tamid's names
table updated. Doorpost re-pinned.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

specs/bikoret_tamid.md

@@ -377,7 +377,7 @@ and why, until the kohen moves it:
 |---|---|---|
 | Kubernetes | namespace `shorashim`; Deployment/Service/Ingress `shorashim`; labels `app.kubernetes.io/name: shorashim`; Secrets `shorashim-secrets`, `shorashim-migrate-secrets`, `shorashim-api-keys`, `shorashim-registry`; ConfigMap `shorashim-config` | A Deployment's selector is immutable and a namespace cannot be renamed: moving them is a delete-and-recreate with the secrets re-issued by the kohen (the builder cannot copy secrets). Do it as one cut-over, at a quiet hour, with the manna written first |
 | PostgreSQL | role `shorashim_app`; databases `shorashim` | An existing role in the managed database; renaming it is the kohen's DDL (`ALTER ROLE … RENAME`) and a rotation of `DATABASE_URL` in both secrets |
-| DNS | `shorashim.ch`, `mcp.shorashim.ch`, the issuer mail | The transmitter's domain; whether `bikoret.ch` is taken, bought and pointed is his decision — the Ingress host rule follows it |
+| DNS | `shorashim.ch` (still served, no certificate), `mcp.shorashim.ch`, the issuer mail | `bikoret.ch` and `bikoret.org` were registered 2026-10-13; the Ingress serves `bikoret.ch` + `www` with TLS and redirects `.org` to it (`deploy/k8s/service.yaml`, KOHEN Day 8). The old host stays until its callers have moved |
 | Builder's machine | `~/shorashim` (symlink to `~/bikoret`), `~/shorashim-source-data`, `~/shorashim-operator-notes`, `~/.local/bin/shorashim-rollout` (its name is in a permission rule) | Local paths; the symlink keeps every script and memory pointer working |
 | Gitea | `heaviness510/bikoret` (renamed; the old URL redirects) | — |