docs: reconcile to as-built (ADR-0008, deploy runbook); clean text hero on detail pages

- ADR-0008: private package, External-Secrets pull over public HTTPS (no k3s restart);
  CI auth via CI_TOKEN PAT; Playwright dropped from CI. Marks ADR-0007 partially superseded.
- gitops-deployment-strategy + deployment.md updated to as-built flow + operate/troubleshoot runbook
- content-deviations: detail-page heroes are text-only (no image)
- service/focus detail pages: clean text hero (drop shared photo/icon)

docs/gitops-deployment-strategy.md

@@ -30,22 +30,27 @@ pulls from Git and the image registry.
 > (`10.66.15.22:3000/bmr_bluecap/bcs-website`); ArgoCD Application in `argocd/bcs-website-application.yaml`.
 > Any lingering GitHub/GHCR wording below is the generic model; substitute Gitea/Gitea-Packages.
 
-## Prerequisites
+## Prerequisites & as-built registry flow
 
-Done: repo pushed to Gitea (`bmr_bluecap/bcs-website`, private); `k8s/deployment.yaml` image set to
-the Gitea Packages path; ArgoCD Application manifest written.
+> **As built (2026-07-17) — see [ADR-0008](adr/0008-private-package-external-secrets-pull.md).**
+> The earlier "k3s trusts the HTTP registry + restart" plan was dropped. Final flow avoids any k3s
+> restart or per-node config.
 
-**Still to do before the first deploy works (homelab infra):**
-- **k3s must trust the HTTP registry.** Add a `registries.yaml` entry for `10.66.15.22:3000` as
-  insecure/HTTP (via the k3s role `k3s_registry_mirrors`), then restart k3s — otherwise pods can't
-  pull the image.
-- **Runner host dockerd** needs `10.66.15.22:3000` in `insecure-registries` to push over HTTP.
-- **Docker usable from job containers** (act_runner socket passthrough) — or switch the build to
-  kaniko.
-- **Package visibility:** make the container package **public** (simplest; image is only the public
-  site), or keep it private and add an imagePullSecret (`k8s/deployment.yaml`), ideally via the
-  installed External Secrets operator.
-- Apply the ArgoCD Application (once) or add it to the homelab-gitops app-of-apps.
+**Registry flow (split push/pull, same private Gitea package, two access paths):**
+- **CI pushes** to the **internal** `10.66.15.22:3000/bmr_bluecap/bcs-website` (HTTP, fast). The
+  runner host's dockerd trusts it via `insecure-registries` (gitea Ansible role + SIGHUP
+  live-reload — no restart). Docker in jobs works because act_runner's config pins jobs to
+  `gitea_network` and exposes the docker socket.
+- **k3s pulls** the **public HTTPS** `git.7tl-homelab.com/bmr_bluecap/bcs-website` (valid TLS) →
+  **no `registries.yaml`, no node config, no k3s restart.** (`k3s_registry_mirrors` stays empty.)
+- **Pull auth:** package is **private**; a `read:package` PAT lives in OpenBao (`cluster/bluecap-registry`)
+  and External Secrets (`k8s/externalsecret-registry.yaml`) materializes the `gitea-registry`
+  dockerconfigjson used by the Deployment's `imagePullSecrets`.
+- **CI auth:** dedicated PAT `CI_TOKEN` (repo Actions secret; `write:package` + `write:repository`).
+
+**One-time setup (all done):** repo on Gitea; runner registered (global/instance, on `gitea_network`,
+correct instance URL); `CI_TOKEN` secret; OpenBao `cluster/bluecap-registry`; ArgoCD Application
+applied. Deploys are now push-to-main → CI → ArgoCD, hands-off.
 
 ## Cluster Findings