carbide→nico rename gaps: binary/CLI still dial carbide-api.forge[-system] (DPU heartbeat cert SAN, admin-cli default endpoint)

[kirson-git]

Summary

Several carbide→nico rename gaps remain in v0.10.3 where the running binary/CLI still dial the legacy carbide-api.forge / carbide-api.forge-system names, which don't resolve under the nico-* deployment.

Instances observed

1. DPU heartbeat fails (TLS BadCertificate): the forge-dpu-agent dials the API as carbide-api.forge; the nico-api serving cert lacks that SAN → DPUs stuck at WaitingForNetworkConfig. Workaround: add carbide-api.forge to the nico-api cert dnsNames (extraDnsNames).
2. carbide-admin-cli default endpoint dead: defaults to https://carbide-api.forge-system.svc.cluster.local:1079 (NXDOMAIN); every call needs -c https://nico-api.nico-system.svc.cluster.local:1079.

Proposed fix

Finish the rename: repoint default hostnames to nico-api.nico-system, and/or include the legacy SAN during the transition.