runner: bind-mount host kubectl into job containers; registry domain → neuralplatform.ai

gitea-runner: add container.options to mount /usr/local/bin/kubectl:ro
from the Legion host into every act_runner job container. Eliminates
per-run curl download in CI workflows.

ingress: change registry ingress hostname from registry.nook.family to
registry.neuralplatform.ai. Matches the domain used in Neuron CI and
neuron.yaml image reference. DNS CNAME + tunnel route already added.

servers/legion/apps/gitea-runner.yaml

@@ -38,6 +38,7 @@ spec:
                 network: host
                 docker_host: "unix:///var/run/docker.sock"
                 force_pull: false
+                options: -v /usr/local/bin/kubectl:/usr/local/bin/kubectl:ro
               EOF
           envFrom:
             - secretRef:

servers/legion/ingress.tf

@@ -42,18 +42,22 @@ resource "kubernetes_ingress_v1" "registry" {
     name      = "registry"
     namespace = kubernetes_namespace.registry.metadata[0].name
     annotations = {
-      "traefik.ingress.kubernetes.io/router.entrypoints" = "websecure"
+      "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
-      "cert-manager.io/cluster-issuer"                   = "letsencrypt-prod"
+      "cert-manager.io/cluster-issuer"                          = "letsencrypt-prod"
+      "traefik.ingress.kubernetes.io/router.middlewares"        = "registry-chunked@kubernetescrd"
+      "nginx.ingress.kubernetes.io/proxy-body-size"             = "0"
+      "nginx.ingress.kubernetes.io/proxy-read-timeout"          = "600"
+      "nginx.ingress.kubernetes.io/proxy-send-timeout"          = "600"
     }
   }
 
   spec {
     tls {
-      hosts       = ["registry.${var.domain_suffix}"]
+      hosts       = ["registry.${var.infra_domain}"]
       secret_name = "registry-tls"
     }
     rule {
-      host = "registry.${var.domain_suffix}"
+      host = "registry.${var.infra_domain}"
       http {
         path {
           path      = "/"