chore: publish and document packages at the registry's current Zayin location

The package registry moved with the repositories to
git.zayin.net/api/packages/Zayin/npm/; the old River_of_Glory_Church address
now answers 502, so the next manual Publish packages run would have failed.
Point the workflow, the release and module-development docs, and the
disposable-Gitea publication proof's owner at Zayin. The CI Docker label keys
keep their names: they are identifiers the sweep matches on, not hosts.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.github/workflows/publish-packages.yml

@@ -27,7 +27,7 @@ concurrency:
 
 env:
   # The only registry-specific setting: where the train is published.
-  EKKLESIA_PACKAGES_REGISTRY: https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/
+  EKKLESIA_PACKAGES_REGISTRY: https://git.zayin.net/api/packages/Zayin/npm/
 
 jobs:
   package-release:

docs/development/releases.md

@@ -207,10 +207,10 @@ Two builds of the same commit produce byte-identical tarballs, and CI proves it
 
 ## Publishing the train
 
-The registry is the Gitea npm registry under the `River_of_Glory_Church` owner:
+The registry is the Gitea npm registry under the `Zayin` owner:
 
 ```text
-https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/
+https://git.zayin.net/api/packages/Zayin/npm/
 ```
 
 | Who | May |
@@ -272,7 +272,7 @@ Evidence that one train was published, not a second package catalog, and never a
 {
   "publicationRecord": 1,
   "packageTrain": { "version": "0.2.0", "revision": "<commit>", "manifestSha256": "<hex>" },
-  "registry": "https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/",
+  "registry": "https://git.zayin.net/api/packages/Zayin/npm/",
   "finalTag": "latest",
   "completedAt": "<ISO time>",
   "packages": [
@@ -297,7 +297,7 @@ Evidence that one train was published, not a second package catalog, and never a
 
 - **One credential:** `EKKLESIA_PACKAGES_PUBLISH_TOKEN`, a repository Actions secret, used only by
   the publish step. Nobody needs a token to read or install.
-- **The publisher** is a dedicated account, member only of a `River_of_Glory_Church` team whose one
+- **The publisher** is a dedicated account, member only of a `Zayin` team whose one
   permission is Packages: Write. Its token has only the `write:package` scope. Gitea's
   `write:package` also allows deleting packages; the tool never does, and nothing else uses the
   token.
@@ -319,7 +319,7 @@ guarantee:
 - **A published version is never deleted,** by anyone, for any reason short of a security incident.
 - **A version number is never reused with other bytes.** A version found on the registry with other
   bytes is burned: investigate how it got there, and publish the train under a new version.
-- **No package cleanup rule** may be configured for the `River_of_Glory_Church` owner.
+- **No package cleanup rule** may be configured for the `Zayin` owner.
 - **The publisher never deletes.** The tool has no delete, unpublish, or overwrite, and its tests
   check that.
 
@@ -359,7 +359,7 @@ claim to be source that 0.1.2 never contained.
 Before it, an administrator of the Gitea instance:
 
 1. creates the dedicated publisher account;
-2. creates a `River_of_Glory_Church` team, for example `package-publishers`, with only the Packages
+2. creates a `Zayin` team, for example `package-publishers`, with only the Packages
    unit at Write, and adds the account to it;
 3. creates a token for the account with only `write:package`, and stores it as the repository
    Actions secret `EKKLESIA_PACKAGES_PUBLISH_TOKEN`;

docs/module-development/README.md

@@ -89,7 +89,7 @@ promises no API stability beyond the pre-1.0 SemVer policy. Only Ekklesia's rele
 the registry in your repository's committed `.npmrc`; that is all the configuration there is:
 
 ```ini
-@ekklesia:registry=https://git.riverofglorymn.org/api/packages/River_of_Glory_Church/npm/
+@ekklesia:registry=https://git.zayin.net/api/packages/Zayin/npm/
 ```
 
 Then the module builds and packages like any other:

scripts/test-package-publication.sh

@@ -110,7 +110,7 @@ for user in publisher outsider; do
   password_variable="${user}_password"
   api POST /admin/users "{\"username\":\"$user\",\"password\":\"${!password_variable}\",\"email\":\"$user@example.invalid\",\"must_change_password\":false}" >/dev/null
 done
-owners=(River_of_Glory_Church ekklesia-burned-version ekklesia-tag-retry ekklesia-artifact-layout)
+owners=(Zayin ekklesia-burned-version ekklesia-tag-retry ekklesia-artifact-layout)
 for owner in "${owners[@]}"; do
   api POST /orgs "{\"username\":\"$owner\",\"visibility\":\"public\"}" >/dev/null
   team="$(api POST "/orgs/$owner/teams" '{"name":"package-publishers","includes_all_repositories":false,"can_create_org_repo":false,"units":["repo.packages"],"units_map":{"repo.packages":"write"}}' |