fix(packaging): align ghcr image name to ghcr.io/nullislabs/shepherd

.env.example

@@ -22,4 +22,4 @@ BASE_RPC_URL=wss://base-mainnet.g.alchemy.com/v2/REPLACE_ME
 
 # Optional: override the published image with a locally-built or
 # pinned-by-SHA tag. Leave unset to pull `:latest` from ghcr.io.
-# SHEPHERD_IMAGE=ghcr.io/bleu/nullis-shepherd:sha-abc1234
+# SHEPHERD_IMAGE=ghcr.io/nullislabs/shepherd:sha-abc1234

.github/workflows/docker.yml

@@ -2,11 +2,13 @@
 #
 # Triggers:
 #   - push to `main`               → publish `latest` + `sha-<sha>`
-#   - tag push `v*`                → publish `v<tag>` + `latest`
+#   - tag push `v*`                → publish `v<tag>` + `sha-<sha>`
+#     (`latest` only moves on default-branch pushes, per the
+#     metadata-action `is_default_branch` gate below)
 #   - workflow_dispatch (manual)   → publish `manual-<run_id>`
 #   - pull_request to `main`       → build only, no push (CI smoke)
 #
-# Image: ghcr.io/<owner>/nullis-shepherd
+# Image: ghcr.io/nullislabs/shepherd
 # Auth:  GITHUB_TOKEN (scoped to packages:write below).
 #
 # Pinned action SHAs match the style of `.github/workflows/ci.yml`.

docker-compose.yml

@@ -10,7 +10,7 @@
 # The image either builds from the repo's Dockerfile (`docker compose
 # build`) or pulls the published ghcr.io artefact when the
 # `SHEPHERD_IMAGE` env var is set (CI publishes
-# `ghcr.io/bleu/nullis-shepherd:<sha>` and `:latest` on main).
+# `ghcr.io/nullislabs/shepherd:<sha>` and `:latest` on main).
 #
 # Required mounts:
 #   - ./engine.toml -> /etc/shepherd/engine.toml  (operator-supplied)
@@ -19,7 +19,7 @@
 
 services:
   shepherd:
-    image: ${SHEPHERD_IMAGE:-ghcr.io/bleu/nullis-shepherd:latest}
+    image: ${SHEPHERD_IMAGE:-ghcr.io/nullislabs/shepherd:latest}
     # Comment out `build` if you `docker compose pull` instead of
     # building from source. Leaving it lets `docker compose up
     # --build` re-build from the local checkout when the image

docs/deployment/docker.md

@@ -9,9 +9,9 @@ The image is published on every push to `main` and on every
 `v*` tag:
 
 ```
-ghcr.io/bleu/nullis-shepherd:latest         # main branch HEAD
-ghcr.io/bleu/nullis-shepherd:sha-<short>    # exact-build pin
-ghcr.io/bleu/nullis-shepherd:v0.2.0         # tag
+ghcr.io/nullislabs/shepherd:latest         # main branch HEAD
+ghcr.io/nullislabs/shepherd:sha-<short>    # exact-build pin
+ghcr.io/nullislabs/shepherd:v0.2.0         # tag
 ```
 
 `linux/amd64` only for now (the soak VM is x86_64; add `arm64` once
@@ -23,7 +23,7 @@ an operator surfaces a real need).
 
 ```bash
 # On the VM:
-git clone https://github.com/bleu/nullis-shepherd /opt/shepherd
+git clone https://github.com/nullislabs/shepherd /opt/shepherd
 cd /opt/shepherd
 
 # Operator-supplied RPC URLs. `.env` is gitignored; the template
@@ -126,12 +126,12 @@ docker compose up -d              # picks up the new image; graceful
                                   # before the new container takes over.
 
 # Roll back to a specific build.
-export SHEPHERD_IMAGE=ghcr.io/bleu/nullis-shepherd:sha-abc1234
+export SHEPHERD_IMAGE=ghcr.io/nullislabs/shepherd:sha-abc1234
 docker compose up -d
 
 # Cold roll: stop, prune image, pull fresh.
 docker compose down
-docker image rm ghcr.io/bleu/nullis-shepherd:latest
+docker image rm ghcr.io/nullislabs/shepherd:latest
 docker compose pull && docker compose up -d
 ```
 

docs/production.md

@@ -56,7 +56,7 @@ Before launching:
 ```ini
 [Unit]
 Description=Shepherd (nexum) - CoW Protocol off-chain automation runtime
-Documentation=https://github.com/bleu/nullis-shepherd
+Documentation=https://github.com/nullislabs/shepherd
 After=network-online.target
 Wants=network-online.target