chore(build): drop URL rewrite layer + remove internal-rewrites doc

GitHub is canonical for aldabra now (per 2026-05-10 architecture call —
Gitea is a pull-mirror cache, not a forge we publish to). Build process
fetches pallas direct from github.com, no rewrite needed.

- Dockerfile: drop the `--mount=type=secret` git_credentials dance + the
  url.insteadOf rewrite. cargo fetches pallas straight from
  github.com/Sulkta-Coop/pallas at the locked SHA. No secret needed.
- docs/internal-build-rewrites.md: removed. The rewrite was the entire
  reason for the doc, and the rewrite is gone.

Internal builds (the build host / ci-runner / dev hosts) still hit
github.com for pallas, same as external builds. One extra WAN hop per
crate, but consistent everywhere and no environment-specific config.

Dockerfile

@@ -45,20 +45,7 @@ COPY crates ./crates
 # trick above leaves stale build artifacts otherwise.
 RUN find crates -name '*.rs' -exec touch {} +
 
-# Build-time URL rewrite: route the public github/gitlab pallas URLs
-# (which is what Cargo.toml declares — source-of-truth, portable to
-# external clones) back to the LAN gitea over HTTP+PAT. This is purely
-# a fetch-time short-circuit: no LAN URL or credential is baked into
-# Cargo.lock or the image. The lock file's locked SHA stays identical
-# whether fetched via github, gitlab, or local gitea.
-#
-# Pass `--secret id=git_credentials,src=<file>` where <file> is one
-# line: http://USER:PAT@git.sulkta.com
-RUN --mount=type=secret,id=git_credentials,target=/root/.git-credentials,mode=0400,required=true \
-    git config --global credential.helper store && \
-    git config --global url."https://git.sulkta.com/Sulkta-Coop/".insteadOf "https://github.com/Sulkta-Coop/" && \
-    git config --global url."https://git.sulkta.com/Sulkta-Coop/".insteadOf "https://gitlab.com/sulkta/" && \
-    cargo build --release --bin aldabra && \
+RUN cargo build --release --bin aldabra && \
     strip target/release/aldabra
 
 FROM debian:bookworm-slim AS runtime