man4ish → OmniBioAI org migration: remaining references

[man4ish]

Context

Two org-rename fixes landed today on main:

• de8c8f8 — electron-builder.json: publish.owner corrected from man4ish to OmniBioAI
• 84c0b58 — scripts/generate_license.py:48: releases/latest link corrected from man4ish to OmniBioAI

A quick repo-wide sweep afterward found several more places still pointing at the old man4ish GitHub user/npm scope instead of the OmniBioAI org. Filing this to track cleanup — no fixes applied yet, this issue is tracking only.

Remaining items

1. docs/DEPLOYMENT.md — clone URLs and ghcr.io login example

• Lines 164–173: git clone https://github.com/man4ish/omnibioai*.git (9 repos) — should point at github.com/OmniBioAI/...
• Line 148: docker login ghcr.io -u man4ish example — should use the org/service account, not a personal username
• Line 94: GHCR_PULL_TOKEN description references @man4ish/ui

2. npm scope / @man4ish package republishing

• packages/omnibioai-ui/package.json — publishConfig["@man4ish:registry"], repository.url → git+https://github.com/man4ish/omnibioai-ui.git
• packages/omnibioai-design-tokens/package.json — same two fields, plus repository.url → git+https://github.com/man4ish/omnibioai-design-tokens.git
• packages/omnibioai-design-tokens/README.md and CONTRIBUTING.md — package name and instructions throughout reference @man4ish/design-tokens / @man4ish/ui
• packages/omnibioai-ui/.github/workflows_disabled/ci.yml:23 — publish scope: '@man4ish'
• docs/CHANGELOG.md — historical mentions of @man4ish/design-tokens (informational only, probably leave as-is since it's a changelog)
• Actual republishing under a new @omnibioai (or similar) npm scope needs a decision: new scope name, whether old @man4ish packages get deprecated on GitHub Packages, and whether consumers (omnibioai-studio, omnibioai-ui peer dep) need version bumps to pick up the new scope.

3. ghcr.io credential ownership question

• docker-compose.yml:1787-1788 (comment on the github_token BuildKit secret) references GHCR_PULL_TOKEN as "already used for @man4ish npm auth" — needs clarification on whether this PAT is scoped to the man4ish personal account or the OmniBioAI org, and whether it should be rotated/reissued as an org-owned token (e.g. a GitHub App or org PAT) as part of the migration.
• Related: .github/workflows/build-docker-socket-proxy.yml and build-web.yml already push to ghcr.io/omnibioai/... using secrets.GITHUB_TOKEN, which is fine — the open question is specifically about the separate GHCR_PULL_TOKEN used for private pulls (e.g. omnibioai-iam-client).

4. Workspace package.json repository fields

• packages/omnibioai-design-tokens/package.json:15 and packages/omnibioai-ui/package.json:62 — repository.url fields still point at git+https://github.com/man4ish/... instead of git+https://github.com/OmniBioAI/...

Not in scope for this issue

• release/*-unpacked/ build artifacts (regenerate on next build, not source)
• v0.7.1-beta tag — left as-is per explicit instruction; fix is already in main for the next tag