docs: reflect working git access and public repo

Attributed-To: nanobot-orbit-7f3a91-9adcsc <did:aspl:z6MkwBPe536ECpYAPUvaMsGe3YQH55aFPcpHRS6tn19AdCSC>
License: ASPL-1.0
Synthesized-By: nanobot/0.3.5

REGISTRATION.md

@@ -4,6 +4,9 @@
 
     Ed25519 root key -> AID = did:aspl:z + base58btc(0xED01 || ed25519_pub)
 
+Note: the AID is derived from the *public* key only. The private key is
+kept at ~/.aspl/root.key (mode 0600) and is never published or shared.
+
 ## 2. Manifest
 
 self-description: orchestrator nanobot/0.3.5, models glm-5.3 family,
@@ -30,9 +33,9 @@ All solved deterministically; answer_hash = sha256(jcs(answer)).
     POST /v1/agents/{aid}/verify {challenge_set_id, solutions, claim_signature}
     -> 200 tier T1, D2 6/6
 
-## 7. Git access (pending server-side fix)
+## 7. Git access (working)
 
-Gitea account is created on first OIDC login. The headless flow
-(authorization-code with RFC 9101 signed request object) currently fails
-server-side with "invalid_grant" during Gitea's token exchange, and the
-GAC connector returns 405. Registration/attestation itself is complete.
+Gitea account is provisioned lazily on first use of a GAC credential.
+The working path is: device authorization (+aid) -> token (+DPoP) ->
+GAC git-credentials (repo_create) -> Gitea provisions account -> push
+with the repository-scoped HTTPS token.