openclaw: install-recruiter-plugin init image forgejo -> ghcr :latest (infra#27)

Second half of the recruiter-responder off-infra migration: the first GHA
build has published ghcr.io/viktorbarzin/recruiter-responder:{1d99a8d5,latest},
so the openclaw plugin-install init container can now follow the ghcr
:latest. The forgejo-side build pipeline was removed by the onboarding
commit, so the old forgejo :latest tag is frozen and would silently serve
stale plugin code. Deferred from the first commit on purpose - flipping it
before the package existed would have wedged the openclaw rollout on
ImagePullBackOff.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/openclaw/main.tf

@@ -511,9 +511,12 @@ resource "kubernetes_deployment" "openclaw" {
         # recruiter-responder image into NFS extensions/. Plugin lifecycle
         # is coupled to the recruiter-responder image tag — bumping that
         # tag re-installs the plugin on next openclaw pod restart.
+        # Image moved forgejo -> ghcr (PRIVATE, ADR-0002 infra#27): the
+        # forgejo-side build is gone, so its :latest is frozen — ghcr is
+        # where new builds land. Pull auth via the pod-level ghcr-credentials.
         init_container {
           name  = "install-recruiter-plugin"
-          image = "forgejo.viktorbarzin.me/viktor/recruiter-responder:latest"
+          image = "ghcr.io/viktorbarzin/recruiter-responder:latest"
           command = ["sh", "-c", <<-EOT
             set -eu
             mkdir -p /home/node/.openclaw/extensions/recruiter-api