claude-agent-service image -> ghcr across all five consumer stacks (infra#19)

GHA now builds+pushes ghcr.io/viktorbarzin/claude-agent-service (public
package, anonymous pulls). Repointed: claude-agent-service (deployment +
git-init/seed-beads-agent inits), claude-breakglass, ci-pipeline-health,
beads-server CronJobs, k8s-version-upgrade (tag var 2fd7670d -> latest —
the Forgejo registry lost that sha; node caches were the only thing
keeping those CronJobs alive). publish-gate: vendor-contact emails
(licensing@/legal@/security@/sales@) ruled license-boilerplate, not PII.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/claude-breakglass/main.tf

@@ -20,7 +20,7 @@ locals {
   namespace = "claude-breakglass"
   # Same image as claude-agent-service — the breakglass code lives in that repo
   # under app/breakglass/, and the deployment below overrides the command.
-  image     = "forgejo.viktorbarzin.me/viktor/claude-agent-service"
+  image     = "ghcr.io/viktorbarzin/claude-agent-service"
   image_tag = "latest"
   labels = {
     app = "claude-breakglass"