fix(gitea): raise the memory ceiling; time-bound the demo cleanup calls

Gitea wedged at 2073Mi against a 2Gi limit: its API stopped answering even on
its own loopback, and the repeated SSH LoginGraceTime drops in its log were
starvation symptoms rather than a separate fault. Raised to 3Gi.

The reset command's Gitea calls had no --max-time, so a slow service became an
indefinite hang with no output - the script appeared frozen after 'clearing
bstein/hermes-code-demo'. They now fail after 25 seconds and say so.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/ops/hermes_triage_demo.sh

@@ -112,7 +112,7 @@ cmd_reset() {
     for repo in $DEMO_REPOS; do
       note "clearing bstein/$repo (demo repository)"
       local items
-      items="$(curl -s -H "Authorization: token $GITEA_TOKEN" \
+      items="$(curl -s --max-time 25 -H "Authorization: token $GITEA_TOKEN" \
         "$gitea/api/v1/repos/bstein/$repo/issues?state=all&limit=100" |
         python3 -c 'import json,sys
 for i in json.load(sys.stdin):
@@ -122,14 +122,14 @@ for i in json.load(sys.stdin):
       else
         while read -r num kind; do
           [ -z "$num" ] && continue
-          curl -s -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+          curl -s --max-time 25 -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
             "$gitea/api/v1/repos/bstein/$repo/issues/$num"
           note "  deleted $kind #$num"
         done <<< "$items"
       fi
 
       local branches
-      branches="$(curl -s -H "Authorization: token $GITEA_TOKEN" \
+      branches="$(curl -s --max-time 25 -H "Authorization: token $GITEA_TOKEN" \
         "$gitea/api/v1/repos/bstein/$repo/branches" |
         python3 -c 'import json,sys,urllib.parse
 for b in json.load(sys.stdin):
@@ -139,7 +139,7 @@ for b in json.load(sys.stdin):
         note "  no repair branches"
       else
         for ref in $branches; do
-          curl -s -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
+          curl -s --max-time 25 -o /dev/null -X DELETE -H "Authorization: token $GITEA_TOKEN" \
             "$gitea/api/v1/repos/bstein/$repo/branches/$ref"
           note "  deleted branch $(printf '%b' "${ref//%/\\x}")"
         done
@@ -191,7 +191,7 @@ cmd_preflight() {
   agents="$(kubectl -n jenkins get pods --no-headers 2>/dev/null | grep -cE '\-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{5}' || true)"
   note "jenkins agent pods: ${agents:-0}/${cap:-5} (a full pool stalls the demo — wait for a free slot)"
   local open_prs
-  open_prs="$(curl -s -H "Authorization: token ${GITEA_TOKEN:-}" \
+  open_prs="$(curl -s --max-time 25 -H "Authorization: token ${GITEA_TOKEN:-}" \
     "${GITEA_URL:-https://scm.bstein.dev}/api/v1/repos/bstein/hermes-code-demo/pulls?state=open" 2>/dev/null |
     python3 -c 'import json,sys; print(len(json.load(sys.stdin)))' 2>/dev/null || echo '?')"
   note "open hermes-code-demo PRs: $open_prs (must be 0 — the duplicate guard refuses while one is open)"

services/gitea/deployment.yaml

@@ -288,7 +288,11 @@ spec:
               memory: 1Gi
             limits:
               cpu: 1500m
-              memory: 2Gi
+              # Raised from 2Gi: the pod sat at 2073Mi and wedged, refusing
+              # connections on its own loopback while the API timed out from
+              # everywhere. The SSH LoginGraceTime drops in the log are a
+              # symptom of that starvation, not a separate problem.
+              memory: 3Gi
           volumeMounts:
             - name: gitea-data
               mountPath: /data