docs: reconcile to as-built (ADR-0008, deploy runbook); clean text hero on detail pages

- ADR-0008: private package, External-Secrets pull over public HTTPS (no k3s restart);
  CI auth via CI_TOKEN PAT; Playwright dropped from CI. Marks ADR-0007 partially superseded.
- gitops-deployment-strategy + deployment.md updated to as-built flow + operate/troubleshoot runbook
- content-deviations: detail-page heroes are text-only (no image)
- service/focus detail pages: clean text hero (drop shared photo/icon)

src/styles/global.css

@@ -419,6 +419,23 @@ p {
   padding: 3.5rem 0;
 }
 
+/* Detail pages (services/focus): no hero photo — single column, with an optional icon accent. */
+.page-hero--compact {
+  grid-template-columns: 1fr;
+  max-width: 820px;
+}
+
+/* More specific than `.page-hero img` so the 64px icon isn't stretched to full width. */
+.page-hero .hero-icon {
+  width: 64px;
+  height: 64px;
+  aspect-ratio: auto;
+  object-fit: contain;
+  border-radius: 0;
+  box-shadow: none;
+  margin-bottom: 1.25rem;
+}
+
 .detail-layout {
   display: grid;
   grid-template-columns: minmax(0, 1fr) 320px;