Pull in-estate service images from artifactapi docker-internal

Move the estate's own service/operator image pulls off the Gitea container
registry (git.unkin.net/unkin) to the artifactapi local docker registry, ahead
of the git.unkin.net forge migration which disables Gitea's container registry.
Images were copied digest-for-digest into docker-internal and pulls verified.

- repoint age-api, bind-operator, bind-tsig-api, cephrgw-operator, encapi,
  logarchiver, pdbmux to artifactapi.k8s.syd1.au.unkin.net/docker-internal

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv

apps/base/age-api/deployment.yaml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
         - name: age-api
-          image: git.unkin.net/unkin/age-api:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/age-api:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080

apps/base/bind-internal/tsig-api/tsig-api.yaml

@@ -13,7 +13,7 @@ metadata:
   name: bind-tsig-api
   namespace: bind-internal
 spec:
-  image: git.unkin.net/unkin/bind-tsig-api:v0.2.3
+  image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-tsig-api:v0.2.3
   replicas: 1
   port: 8443
   # targetNamespace defaults to this resource's namespace (bind-internal), where

apps/base/bind-system/deployment.yaml

@@ -21,7 +21,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/bind-operator:v0.2.6
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/bind-operator:v0.2.6
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/cephrgw-system/deployment.yaml

@@ -24,7 +24,7 @@ spec:
         runAsNonRoot: true
       containers:
         - name: operator
-          image: git.unkin.net/unkin/cephrgw-operator:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/cephrgw-operator:v0.4.0
           args:
             - --metrics-bind-address=:8080
             - --health-probe-bind-address=:8081

apps/base/encapi/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       automountServiceAccountToken: true
       containers:
         - name: encapi
-          image: git.unkin.net/unkin/encapi:v0.1.1
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.1
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000

apps/base/logging/deployment_logarchiver.yaml

@@ -39,7 +39,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: logarchiver
-          image: git.unkin.net/unkin/logarchiver:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/logarchiver:v0.1.0
           imagePullPolicy: IfNotPresent
           args: ["run"]
           securityContext:

apps/base/pdbmux/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         - name: pdbmux
           # Image is published by the pdbmux repo's .woodpecker/docker.yaml on
           # a v* tag. It only exists after that tag is cut (see PR merge gates).
-          image: git.unkin.net/unkin/pdbmux:v0.1.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/pdbmux:v0.1.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080