api/bot: imagePullSecrets gitea-registry -> gitea-registry-infisical. dashboard: add gitea-registry-infisical (previously had NO pull secret despite pulling a private image — fixes latent ErrImagePull-on-reschedule bug). Old gitea-registry stays as rollback net until decommission. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>