ci: apply + drift steps run on ghcr infra-ci (ADR-0002 #30)

The terragrunt apply step (default.yml) and drift-detection now pull
ghcr.io/viktorbarzin/infra-ci:latest (GHA-built, verified toolchain:
tf 1.5.7 / tg 0.99.4 / sops / kubectl 1.34 / vault / git-crypt). ghcr is
public + proven pullable in-cluster. build-ci-image.yml (forgejo build)
KEPT as the fallback copy until this ghcr-based apply is proven, so a
revert restores the working forgejo image if needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.woodpecker/default.yml

@@ -45,7 +45,7 @@ steps:
           "$SLACK_WEBHOOK" || true
 
   - name: apply
-    image: forgejo.viktorbarzin.me/viktor/infra-ci:latest
+    image: ghcr.io/viktorbarzin/infra-ci:latest
     pull: true
     backend_options:
       kubernetes:

.woodpecker/drift-detection.yml

@@ -14,7 +14,7 @@ clone:
 
 steps:
   - name: detect-drift
-    image: forgejo.viktorbarzin.me/viktor/infra-ci:latest
+    image: ghcr.io/viktorbarzin/infra-ci:latest
     pull: true
     backend_options:
       kubernetes: