blog: republish 2 edited posts, dossier thumbnails 4-6, new post broker-pattern

Content: shipping-this-site + init-gating-gpu-readiness get their edited-workshop bodies (from the
NAS Published/ pass) - site frontmatter (hero/heroAlt) kept, only prose replaced.

Dossiers 004-006 (gpu-as-code, global-infra-modernisation, network-automation-fleet) were all
rendering the same generic pipeline thumbnail - added 3 tailored DossierThumb motifs (gpu die +
passthrough lanes, region globe, switch-fleet grid) via a new diagram: frontmatter field. Also
closed the dead-space gap above the tag row on short-argument cards with a faint on-theme grid
fill (::before, masked fade) instead of a flat void.

New post: broker-pattern ('An agent should never hold the key it's using') - SECURITY SERIES 02,
between secret-zero and workload-least-privilege. Hero de-watermarked from the NAS source (resized
to the calibrated 1600x1073 coordinate space, Jacobi-diffused out the Nano Banana sparkle at its
known center) via scripts/dewatermark-broker-pattern.mjs (reusable for the next 3 drafts). New
diagram/broker-pattern.svg in the house light-card palette. Inline top-of-body hero stripped per
the astro-static-site skill guard (frontmatter hero: is now the only render path).

src/content/blog/shipping-this-site.md

@@ -8,25 +8,28 @@ heroAlt: "A glowing data container travels a luminous rail from a small server r
 
 ---
 
-This site is a static Astro build, but how it gets to you is the interesting part. It's
-served from my homelab Kubernetes cluster over a Cloudflare Tunnel, deployed the same way I'd
-ship anything else: as an immutable image, pinned by digest, reconciled by GitOps.
+This site is a static Astro build, and that's the least interesting thing about it. What matters
+is how it reaches you: served from my homelab Kubernetes cluster over a Cloudflare Tunnel, shipped
+the way I'd ship anything I actually cared about — an immutable image, pinned by digest, reconciled
+by GitOps. No special case for "it's just a website."
 
 ## The pipeline
 
-1. The site is built and baked into a hardened `nginx-unprivileged` image.
-2. The image is pushed to a **self-hosted public Gitea registry** — deliberately separate
-   from the private instance that holds my infrastructure code.
-3. The image digest is pinned in a private `home-ops` repo.
-4. **ArgoCD** reconciles that repo onto the cluster.
-5. A **Cloudflare Tunnel** exposes exactly one service — this site — outbound-only.
+The build is baked into a hardened `nginx-unprivileged` image and pushed to a **self-hosted public
+Gitea registry** — deliberately a separate instance from the private one holding my infrastructure
+code, so the public artifact and the private estate never share a trust boundary. The image digest
+is then pinned in a private `home-ops` repo, **ArgoCD** reconciles that repo onto the cluster, and
+a **Cloudflare Tunnel** exposes exactly one service — this site — outbound-only.
 
-No open ports. No server runtime. No registry credential on the cluster, because the public
-package is anonymous-pull and the image holds nothing secret.
+Follow the chain and notice what's missing. No open ports: the tunnel dials out. No server runtime:
+the output is static files behind nginx. No registry credential on the cluster: the public package
+is anonymous-pull, and the image holds nothing secret to protect. Every link in the pipeline is
+either immutable, declarative, or absent.
 
 ## Security as acceptance criteria
 
-The interesting constraint was treating security as a checklist to *pass*, not a vibe:
+The discipline that made it work was treating security as a checklist to *pass*, not a vibe to
+gesture at. The site didn't ship until every box was ticked:
 
 ```text
 [x] Static output — no server runtime to attack
@@ -36,8 +39,14 @@ The interesting constraint was treating security as a checklist to *pass*, not a
 [x] Outbound-only tunnel, single hostname, no catch-all
 ```
 
-## Why bother
+A checklist sounds bureaucratic until you notice what it changes: each item is a claim you can
+verify, and a failing item blocks the ship. "Pretty secure" isn't a state you can test for.
+`grep` finding zero secrets in the bundle is.
 
-Because the site *is* the argument. A platform engineer's portfolio should demonstrate the
-discipline it's advertising — and "it's a static page" is no excuse to skip the rigour. The
-deployment story is part of the work.
+## The principle
+
+The site *is* the argument. A platform engineer's portfolio should demonstrate the discipline it
+advertises, and "it's a static page" is no excuse to skip the rigour — it's the cheapest possible
+place to practise it. If the pipeline behind a brochure site is immutable, verified, and
+zero-trust, that's not overkill. That's the standard, rehearsed where the stakes are low so it
+holds where they aren't.