Redeploy the demo without a running registry

The continuous demo deploy used to push its images to the demo's own registry and ask the demo API for the platform project first. A broken demo (for example an OOM crash loop) therefore could not be repaired by a deploy.

How it works now

scripts/deploy-demo-registry.sh probes https://demo.orbitalreg.com/health/ready for about 60 seconds:

Probe	registry_kind	Images	Repo bootstrap
healthy	demo	demo.orbitalreg.com/platform/images/orbitalreg-{api,frontend,scanner}:sha-<short>	runs
unhealthy	ghcr	ghcr.io/<owner>/orbitalreg-{api,frontend,scanner}:sha-<short>	skipped

In the GHCR case the three packages must be public; the cluster pulls them anonymously, so no pull secret is created and global.imagePullSecrets is unset.

After a GHCR rollout, scripts/deploy-demo-mirror.sh copies the images into the demo registry once it is healthy again (best-effort; a warning if it is still down), so the next normal deploy lands there.

Dry run

# Unhealthy demo -> GHCR branch
CURL_BIN=false GHCR_OWNER=Acme TAG=sha-abc1234 PROBE_ATTEMPTS=1 bash scripts/deploy-demo-registry.sh
# Remote side without touching the cluster
DRY_RUN=1 REGISTRY_KIND=ghcr TAG=sha-abc1234 SHA=abc IMAGE_BASE=ghcr.io/acme/orbitalreg \
  SELF_REGISTRY=demo.orbitalreg.com PULL_SECRET=x TOKEN=t bash scripts/deploy-demo-remote.sh

Tests: scripts/deploy-demo-registry-test.sh, scripts/deploy-demo-remote-test.sh.

Workflow wiring

The deploy-demo.yml change needs workflows: write, which the bot token lacks. The operator applies docs/patches/item-404-deploy-demo.patch (git apply docs/patches/item-404-deploy-demo.patch, already checked with actionlint).