fix(ci): repair nightly backend dep bumps for renamed localai-org repos (#11012)

The "Bump Backend dependencies" workflow has failed every night for over
ten days. Four upstreams — ced.cpp, moss-transcribe.cpp, voice-detect.cpp
and rf-detr.cpp — moved from the mudler org to localai-org, so the GitHub
API answers 301 for the old slugs. ced.cpp additionally renamed its
default branch to main.

bump_deps.sh fetched without -L or -f and never checked the response, so
the redirect's JSON body was passed straight to sed, which died with
"unterminated `s' command". The loud failure was luck: an error body
without slashes would have been substituted into the Makefile as the new
pin, silently corrupting the version and shipping it in a bump PR.

Point the matrix at the new slugs and branch, and harden the script so a
bad response can never reach sed: follow redirects, fail on HTTP errors,
and require a bare 40-hex SHA before rewriting anything. Also refresh the
now-stale repository URLs in the backend Makefiles, test scripts,
backend/index.yaml and the docs.

Verified all 25 matrix entries resolve to a commit SHA and that the four
previously-failing jobs run end to end against the real API.

Assisted-by: Claude:claude-opus-4-8 [Claude Code]

Co-authored-by: localai-org-maint-bot <306269227+localai-org-maint-bot@users.noreply.github.com>

.github/bump_deps.sh

@@ -9,7 +9,19 @@ if [ -z "$FILE" ]; then
     FILE="Makefile"
 fi
 
-LAST_COMMIT=$(curl -s -H "Accept: application/vnd.github.VERSION.sha" "https://api.github.com/repos/$REPO/commits/$BRANCH")
+# -L so a renamed/transferred upstream repo (GitHub answers 301) still
+# resolves instead of handing us the redirect body, and -f so an HTTP error
+# aborts the run rather than letting an error page reach sed below.
+LAST_COMMIT=$(curl -sfL -H "Accept: application/vnd.github.VERSION.sha" "https://api.github.com/repos/$REPO/commits/$BRANCH")
+
+# Guard the sed input: anything that is not a bare 40-hex SHA (an API error
+# body, an empty response) would otherwise be spliced into the Makefile pin —
+# either corrupting it silently or blowing up sed with an unterminated
+# expression, which is how this job failed for a renamed repo.
+if ! [[ "$LAST_COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "Refusing to bump $VAR: expected a 40-char commit SHA for $REPO@$BRANCH, got: $LAST_COMMIT" >&2
+    exit 1
+fi
 
 # Read $VAR from Makefile (only first match)
 set +e

.github/workflows/bump_deps.yaml

@@ -50,15 +50,15 @@ jobs:
             variable: "PARAKEET_VERSION"
             branch: "master"
             file: "backend/go/parakeet-cpp/Makefile"
-          - repository: "mudler/moss-transcribe.cpp"
+          - repository: "localai-org/moss-transcribe.cpp"
             variable: "MOSS_VERSION"
             branch: "master"
             file: "backend/go/moss-transcribe-cpp/Makefile"
-          - repository: "mudler/ced.cpp"
+          - repository: "localai-org/ced.cpp"
             variable: "CED_VERSION"
-            branch: "master"
+            branch: "main"
             file: "backend/go/ced/Makefile"
-          - repository: "mudler/voice-detect.cpp"
+          - repository: "localai-org/voice-detect.cpp"
             variable: "VOICEDETECT_VERSION"
             branch: "master"
             file: "backend/go/voice-detect/Makefile"
@@ -90,7 +90,7 @@ jobs:
             variable: "SAM3_VERSION"
             branch: "main"
             file: "backend/go/sam3-cpp/Makefile"
-          - repository: "mudler/rf-detr.cpp"
+          - repository: "localai-org/rf-detr.cpp"
             variable: "RFDETR_VERSION"
             branch: "main"
             file: "backend/go/rfdetr-cpp/Makefile"