chrome-service-novnc + android-emulator images -> ghcr (ADR-0002 #29/#30)

Both now built by GHA → public ghcr. Repoint stack image bases
forgejo→ghcr:latest (terragrunt-managed, imagePullPolicy Always picks up
rebuilds). android var default api36-v8 -> latest.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/android-emulator/main.tf

@@ -101,7 +101,7 @@ resource "kubernetes_deployment" "android-emulator" {
         }
         container {
           name  = "emulator"
-          image = "forgejo.viktorbarzin.me/viktor/android-emulator:${var.image_tag}"
+          image = "ghcr.io/viktorbarzin/android-emulator:${var.image_tag}"
 
           security_context {
             privileged = true # /dev/kvm access

stacks/android-emulator/variables.tf

@@ -5,6 +5,6 @@ variable "tls_secret_name" {
 
 variable "image_tag" {
   type        = string
-  default     = "api36-v8"
-  description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built + pushed manually from stacks/android-emulator/docker/ (see README.md) — bump this when the image is rebuilt."
+  default     = "latest"
+  description = "android-emulator image tag at forgejo.viktorbarzin.me/viktor/android-emulator. Built by GHA (.github/workflows/build-android-emulator.yml) -> ghcr.io/viktorbarzin/android-emulator on changes to stacks/android-emulator/docker/ (ADR-0002). :latest tracks the newest build."
 }

stacks/chrome-service/main.tf

@@ -324,7 +324,7 @@ resource "kubernetes_deployment" "chrome_service" {
         container {
           name = "novnc"
           # Phase 3 cutover 2026-05-07 — Forgejo registry consolidation.
-          image             = "forgejo.viktorbarzin.me/viktor/chrome-service-novnc:v4"
+          image             = "ghcr.io/viktorbarzin/chrome-service-novnc:latest"
           image_pull_policy = "IfNotPresent"
           port {
             name           = "http"