the name: Bikoret — code, contracts, images

Headers X-Bikoret-Key / -Rebuke / -Verdict / -Bedikah; the `bikoret`
object and the "— bikoret …" fringe on a gate reply; environment
variables BIKORET_*; the image user and paths (/home/bikoret,
/tmp/bikoret, /var/lib/bikoret/manna, /etc/bikoret/secrets,
/opt/bikoret/spec); the tmp-bikoret pod volume; local databases
bikoret_dev/_test. Kubernetes resource names, the shorashim_app role and
the domain are unchanged (Tamid §1.1, "the names that still carry the
old word"). Doorpost c963c4fe…. Elixir 604/0, L3 10/0, korban 295,
Prolog bedikah 44/44. Gitea repo renamed heaviness510/bikoret (old URL
redirects).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/k8s/service.yaml

@@ -1,4 +1,4 @@
-# Shorashim Services
+# Bikoret Services
 # Operations spec §1.1: Four access tiers
 #   - Pe'ah (public, no auth)
 #   - Machaneh Leviyah (authenticated)
@@ -28,7 +28,7 @@ spec:
 # The gate to the world — through the shared ingress
 # ============================================================
 #
-# Until 2026-10-06 Shorashim had its own LoadBalancer Service
+# Until 2026-10-06 Bikoret had its own LoadBalancer Service
 # (`shorashim-external`, NLB 185.19.29.180, NodePort 30923). It is gone:
 # one NLB per Service was a third of the account's bill, and the pod saw
 # every caller as the node (kube-proxy SNAT) so the pe'ah's per-IP watch