webpage: the four git-syncs read Gitea in-cluster; sidecars retry forever (--max-failures=-1); gate 6 keeps the --repo values identical

On 2026-10-19 09:24 the public path to Gitea failed once and the sidecar exited (max-failures defaults to 0).
Anonymous in-cluster fetch proven first (main and installer-v1.34.0 resolve to the public hashes).

scripts/hostinstall_gates.py

@@ -216,6 +216,15 @@ if wp is not None:
     else:
         fail("manifests/webpage.yaml no longer tracks main for the website — pinning the SITE to "
              "the installer tag turns every copy edit into a release")
+    # All four git-sync containers (two sidecars, two init containers) must read the SAME repo: they moved to
+    # the in-cluster Gitea address together (2026-10-19), and an init container left on another URL seeds the
+    # pod from a different source than the sidecar that keeps it fresh.
+    repos = re.findall(r'--repo=(\S+)', wp)
+    if len(repos) == 4 and len(set(repos)) == 1:
+        ok("manifest: all four git-syncs read the same repo (%s)" % repos[0])
+    else:
+        fail("manifests/webpage.yaml: the git-sync `--repo` values differ or are not four (%s) — the "
+             "sidecars and init containers must read one repo" % ", ".join(repos))
 
 # ── R-185: every path that RESOLVES the backup target must also grant on it ──────────────────
 #