Move Kamal engine images to private registry namespace

Publish Kamal engine images under the existing private Gitea/Forgejo organization prk-private instead of public unknown/engines. Make repository changes in a separate worktree to preserve ongoing navmesh work. Verify organization membership, deployment credential access, authenticated image access and anonymous denial. Do not restart live services or trigger deployment without approval. Private replacements and host pull access are verified. User explicitly authorized immediate deletion of all container images owned by Unknown to end public exposure, before deployment branch integration. Preserve prk-private packages and running services; verify public packages are gone and private access still works. Acceptance: private registry push/pull works, anonymous access fails, shared Kamal image configuration targets prk-private/engines, and any rollout/cleanup blockers are explicit. Verified setup: prk-private has private visibility and Unknown is an owner. Copied latest-ithaca, latest-ergo and their current commit tags (16e2352911449e4ee33d86addcf6a53f42075eff and cdba9963913f47ec3be8b9ab6bc7f2d94c5ffcf8) with unchanged manifest digests. Authenticated registry writes/reads and Ithaca Docker pull passed; anonymous manifest/blob requests return HTTP 401 and clean-config Docker pulls are denied. CI KAMAL_REGISTRY_PASSWORD was synchronized to the verified existing Ithaca deployment credential. Both destinations pass kamal config validation. Rollout: config/deploy.yml is committed and pushed as 87d79591b in /home/mathias/Projects/worktrees/engines-private-kamal-images on fix/private-kamal-images, based on origin/develop. PR #2567 is merged into develop: https://git.project-rk.com/prk/engines/pulls/2567. Verified remote develop config uses prk-private/engines. Ergo deployment is verified: all seven current engine/portal containers run private image 05d2bed25e6dbb02882ad3fc5f09051a8e7f0caa, and Unknown still owns zero container packages. User confirmed deployment always promotes develop to main, carrying the namespace change. Ithaca's cutover is intentionally deferred to its next normal deployment cycle; existing containers can continue using their cached images. No services were restarted by this work. Ergo host verification passed with strict host-key checking using its existing ED25519 key from trusted Ithaca's known_hosts. Its existing Unknown Docker credentials pulled the private current commit tag, whose local image ID matches the running public build. Anonymous pull was denied (unauthorized: reqPackageAccess); running container IDs, start times, restart counts and image references were unchanged. No key or credential changes were needed on Ergo. Removed all 23 Unknown-owned registry container package versions with explicit user approval. Paginated package listing confirms zero container versions remain under Unknown; all eight prk-private versions are unchanged. Verified both private latest manifests and every referenced blob remain accessible with authentication; old public latest tags, a known manifest digest and a known blob return HTTP 404. Public-namespace pulls/rollbacks now fail; current Ithaca/Ergo builds are preserved privately. Develop has switched to the private namespace; main must still switch before production deployment to avoid republishing publicly. The obsolete Ergo engines-webapi container (PRK.WebAPI, absent from current Kamal config and referencing a removed Traefik entrypoint) was stopped and removed with user approval, along with its local image tag d72a6a77076f9aabf428ffd39fba3b381f004d2a. Verified its container and image are absent, all other container states are unchanged, and /root/GameData remains present. The later explicitly authorized registry cleanup removed all Unknown-owned container versions; private registry images were preserved.