chore(ci): source registry host from secrets.REGISTRY_URL

All three image build workflows previously hardcoded REGISTRY=codeberg.org
and only pulled USER/PASSWORD from secrets. Switching the URL to come from
the same secrets bag means a registry rotation only needs the
REGISTRY_URL / REGISTRY_USER / REGISTRY_PASSWORD secrets updated, not a
commit to every workflow file.

.forgejo/workflows/build-base.yaml

@@ -22,13 +22,11 @@ on:
     - cron: '0 6 * * 0'
   workflow_dispatch:
 
-# Base image lives on Codeberg's container registry. The shared
-# REGISTRY_USER / REGISTRY_PASSWORD secrets are set to Codeberg
-# credentials; the registry URL is hardcoded here rather than read
-# from secrets.REGISTRY_URL so the workflow can't accidentally push
-# to a different registry if that secret drifts.
+# Base image lives on Codeberg's container registry. Registry host
+# and creds are sourced from the shared REGISTRY_URL / REGISTRY_USER
+# / REGISTRY_PASSWORD secrets.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop-base
 
 concurrency:
@@ -97,12 +95,9 @@ jobs:
 
       - name: Log in to Codeberg container registry
         run: |
-          # Reuses the shared REGISTRY_USER / REGISTRY_PASSWORD
-          # Forgejo Actions secrets — already set with Codeberg
-          # credentials (token must have `write:package` scope).
-          # Login URL is the hardcoded env.REGISTRY rather than
-          # secrets.REGISTRY_URL so this workflow can't accidentally
-          # push to whatever registry the URL secret points at.
+          # Reuses the shared REGISTRY_URL / REGISTRY_USER /
+          # REGISTRY_PASSWORD Forgejo Actions secrets (Codeberg
+          # token must have `write:package` scope).
           attempt=1
           max_attempts=3
           while : ; do

.forgejo/workflows/build-grid-rs.yaml

@@ -12,7 +12,7 @@ on:
 
 # Hosted on Codeberg's container registry. Same setup as build.yaml.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop-grid-rs
 
 concurrency:

.forgejo/workflows/build.yaml

@@ -5,12 +5,12 @@ on:
     branches:
       - main
 
-# Hosted on Codeberg's container registry. The shared
-# REGISTRY_USER / REGISTRY_PASSWORD secrets carry the Codeberg
-# token; URL is hardcoded so a wrong/missing secrets.REGISTRY_URL
-# can't push to the wrong registry.
+# Hosted on Codeberg's container registry. Registry host + creds
+# are sourced from the shared REGISTRY_URL / REGISTRY_USER /
+# REGISTRY_PASSWORD secrets so the registry can be rotated without
+# editing every workflow file.
 env:
-  REGISTRY: codeberg.org
+  REGISTRY: ${{ secrets.REGISTRY_URL }}
   IMAGE_NAME: gmcintire/prop
 
 concurrency: