Upload kernel deb straight to origin, bypassing Cloudflare's 100MB cap

The Actions runner is overseas, so git.chilldove.com resolves to Cloudflare anycast. Cloudflare free/pro rejects request bodies over 100MB with HTTP 413 at the edge, and the linux-image .deb exceeds 100MB, so every publish failed. The Gitea origin itself accepts the upload (verified to >=110MB); only the CDN edge rejects it.

Pin the publish curl to the registry origin via curl --resolve, sourced from the new PKG_ORIGIN_IP repo variable (no IP baked into git; SNI/Host stay git.chilldove.com so TLS and package routing are unchanged). Document the prerequisite in README and the migration spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/superpowers/specs/2026-06-17-apt-repo-migration-design.md

@@ -58,6 +58,11 @@
 - CI 需 `PKG_TOKEN` secret（有 `write:package` scope）；自动注入的 `GITHUB_TOKEN` 不保证有
   包写权限。
 - registry 保留历史版本以支撑「装指定版本」；将来再议 retention。
+- **上传路径不能经过有 body 上限的 CDN**（落地后实测补记）：`git.chilldove.com` 对境外
+  runner 走 Cloudflare（orange-cloud），CF 免费/Pro 版 100 MB 请求体上限会把 >100 MB 的内核
+  镜像 `.deb` 在边缘 413（源站 Baguette 实测可收 ≥110 MB）。CI 须配 Gitea 仓库变量
+  `PKG_ORIGIN_IP`，发布步骤用 `curl --resolve` 直连源站绕过 CF。详见
+  [[工程实践/案例/2026-06-17 Gitea Debian registry 上传被 Cloudflare 100MB body 上限 413]]。
 
 ## 不做（YAGNI）