fix(registry): dev never falls back to the public registry

BaseURL() in dev mode used to silently fall back to https://git.dcntrlized.org
when DCNTRLIZED_GITEA_URL was unset — a dev Maestro could resolve installs and
infra from the wrong (and cred-less) registry. Dev now uses the debug registry
exclusively; an unset URL returns '' so registry ops fail loudly. Locked with
a BaseURL seam test.

src/lib/registry/registry.go

@@ -42,13 +42,17 @@ import (
 )
 
 // BaseURL returns the Gitea instance base URL (scheme://host[:port]).
-// Production defaults to git.dcntrlized.org; dev mode (DCNTRLIZED_DEV=true)
+// Production defaults to git.dcntrlized.org. Dev mode (DCNTRLIZED_DEV=true)
-// overrides it with DCNTRLIZED_GITEA_URL when set.
+// uses DCNTRLIZED_GITEA_URL (the debug registry) exclusively and never falls
+// back to the public one; when the dev URL is unset it returns "" so callers
+// fail loudly instead of silently talking to the wrong registry.
 func BaseURL() string {
 	if env.IsDev() {
 		if u := strings.TrimRight(env.GiteaURL(), "/"); u != "" {
 			return u
 		}
+		logger.Warn("registry: DCNTRLIZED_DEV=true but DCNTRLIZED_GITEA_URL is unset — refusing to fall back to the public registry")
+		return ""
 	}
 	return "https://git.dcntrlized.org"
 }

src/lib/registry/registry_test.go

@@ -50,3 +50,24 @@ func TestItemByNameLive(t *testing.T) {
 		t.Logf("resolved %s -> image=%s url=%s version=%s", name, item.Image, item.URL, item.Version)
 	}
 }
+
+// TestBaseURLNeverFallsBackToPublicInDev locks the dev registry seam: with
+// DCNTRLIZED_DEV=true Maestro must talk to the debug registry
+// (DCNTRLIZED_GITEA_URL) only — an unset dev URL yields "" (loud failure),
+// never the public git.dcntrlized.org.
+func TestBaseURLNeverFallsBackToPublicInDev(t *testing.T) {
+	t.Setenv("DCNTRLIZED_DEV", "true")
+	t.Setenv("DCNTRLIZED_GITEA_URL", "http://192.168.122.183:3000")
+	if got := BaseURL(); got != "http://192.168.122.183:3000" {
+		t.Fatalf("dev with DCNTRLIZED_GITEA_URL: got %q", got)
+	}
+	t.Setenv("DCNTRLIZED_GITEA_URL", "")
+	if got := BaseURL(); got != "" {
+		t.Fatalf("dev without DCNTRLIZED_GITEA_URL must not fall back to public, got %q", got)
+	}
+	t.Setenv("DCNTRLIZED_DEV", "")
+	t.Setenv("DCNTRLIZED_GITEA_URL", "http://192.168.122.183:3000")
+	if got := BaseURL(); got != "https://git.dcntrlized.org" {
+		t.Fatalf("production must use the public registry, got %q", got)
+	}
+}