chore: repoint pipeline at the novoyuuparosk-wiki org

This repo and the three source repos moved from the `mikkeli` account
into the `novoyuuparosk-wiki` org. Rewrites cover repo paths only —
the `mikkeli:` HTTP basic-auth usernames stay, since FAPAT/PKGRW_PAT
remain personally owned, as do the `3005/mikkeli/*` image paths
(Gitea cannot transfer packages).

Bot identity moves to `Mikkeli@giteaBot`; both accounts hold the bot
right, so edits stay flagged as bot edits.

README.md

@@ -6,9 +6,9 @@ CI/CD pipelines that auto-apply commits to https://wiki.novoyuuparosk.org from u
 
 | Path | Source repo | Purpose | Status |
 |---|---|---|---|
-| [`pipelines/songs/`](pipelines/songs/) | `mikkeli/ncmr-songs` | Song lyric pages | v1 live |
-| [`pipelines/ses/`](pipelines/ses/) | `mikkeli/ses-light-novel` | SES light novel pages | v1 in development |
-| [`pipelines/tech/`](pipelines/tech/) | `mikkeli/tech-blogs` | Tech blog posts | v1 live |
+| [`pipelines/songs/`](pipelines/songs/) | `novoyuuparosk-wiki/ncmr-songs` | Song lyric pages | v1 live |
+| [`pipelines/ses/`](pipelines/ses/) | `novoyuuparosk-wiki/ses-light-novel` | SES light novel pages | v1 in development |
+| [`pipelines/tech/`](pipelines/tech/) | `novoyuuparosk-wiki/tech-blogs` | Tech blog posts | v1 live |
 
 Per-pipeline READMEs cover everything specific to that pipeline (source schema, renderer, runtime, decisions). This root README covers only what's cross-cutting.
 
@@ -35,9 +35,11 @@ Note: `workflow_call` across private repos was abandoned — the auto-generated
 
 ## Bot identity
 
-MediaWiki BotPassword issued for user `Dubrowski`, bot name `giteaAutomaton`. Login form: `Dubrowski@giteaAutomaton`.
+MediaWiki BotPassword issued for user `Mikkeli`, bot name `giteaBot`. Login form: `Mikkeli@giteaBot`.
 
-Credentials are stored in the Gitea user-scope secret vault under `mikkeli` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo.
+Both this and the previous `Dubrowski` identity hold the `bot` right, so pipeline edits stay flagged as bot edits and keep out of default Recent Changes — `mwclient`'s `page.save()` requests the bot flag and the wiki honours it.
+
+Credentials are stored in the Gitea org-scope secret vault under `novoyuuparosk-wiki` (`WIKI_BOT_USER`, `WIKI_BOT_PASSWORD`). Not stored in this repo.
 
 ## Runner infrastructure
 
@@ -57,12 +59,13 @@ A follow-up `pin` job then rewrites the `image:` pin in each `publish-*.yml` to
 
 ## Gitea Actions setup (cross-cutting)
 
-Secrets and variables are scoped to user `mikkeli` (no orgs on this instance), inherited by all repos under that account.
+Secrets and variables are scoped to the `novoyuuparosk-wiki` org, inherited by all repos under it. Runs belong to the *caller* repo, so a source repo calling a reusable workflow here resolves secrets and variables from its own owner — which is why they live at org scope rather than on this repo.
 
 **Secrets:**
-- `WIKI_BOT_USER` = `Dubrowski@giteaAutomaton`
+- `WIKI_BOT_USER` = `Mikkeli@giteaBot`
 - `WIKI_BOT_PASSWORD` = the value from *Bot identity* above
-- `FAPAT` = Full-Access PAT under `mikkeli`, used by source-repo workflows to clone this repo at runtime
+- `FAPAT` = Full-Access PAT owned by `mikkeli`, used by source-repo workflows to clone this repo at runtime. The PAT stays personal; only its storage scope moved to the org — hence the `mikkeli:` basic-auth username in the clone URLs.
+- `PKGRW_PAT` = package read/write PAT owned by `mikkeli`, used by `build-image.yml` to push to the container registry
 
 **Variables:**
 - `WIKI_BASE_URL` = `https://wiki.novoyuuparosk.org`
@@ -83,6 +86,8 @@ Secrets and variables are scoped to user `mikkeli` (no orgs on this instance), i
 | Runner execution | Docker, added as a service to the existing Gitea docker-compose | 2026-06-09 |
 | Runner network mode | `host` — job containers need to reach Gitea on localhost | 2026-06-09 |
 | Secret/runner scope | User-level on `mikkeli` (no orgs on this instance) | 2026-06-09 |
+| Ownership | This repo and all three source repos moved to the `novoyuuparosk-wiki` org. Keeping caller and callee under one owner avoids the cross-owner read gate on private reusable workflows (Settings → Actions → General → collaborative owners, Gitea 1.26+). Secrets/variables re-created at org scope; runner must serve org-owned runs | 2026-08-11 |
+| Container registry | Packages are not transferable in Gitea, so images stay at `pi5-16.local:3005/mikkeli/*` for now. Registry auth still uses the `mikkeli`-owned `PKGRW_PAT` | 2026-08-11 |
 | MediaWiki API path | `api.php` (classic action API) | 2026-06-09 |
 | Branch naming (this repo) | `automation/<pipeline>` for pipeline-development branches | 2026-06-09 |
 | Variable naming | `URL_TO_GITEA` not `GITEA_URL` — Gitea blocks `GITEA_`/`GITHUB_` prefixes | 2026-06-09 |
@@ -92,9 +97,9 @@ Per-pipeline decisions live in each pipeline's README.
 
 ## Setup checklist (cross-cutting)
 
-Via the Gitea web UI logged in as `mikkeli`:
+Via the Gitea web UI logged in as `mikkeli` (an owner of `novoyuuparosk-wiki`):
 
-- [x] User-scoped secrets and variables set per *Gitea Actions setup* above
+- [x] Org-scoped secrets and variables set per *Gitea Actions setup* above
   - [x] `WIKI_BOT_USER`
   - [x] `WIKI_BOT_PASSWORD`
   - [x] `FAPAT` (Full-Access PAT — value not stored in this README; saved directly into the Gitea secret. Regenerate if lost.)