blog: republish 2 edited posts, dossier thumbnails 4-6, new post broker-pattern

Content: shipping-this-site + init-gating-gpu-readiness get their edited-workshop bodies (from the
NAS Published/ pass) - site frontmatter (hero/heroAlt) kept, only prose replaced.

Dossiers 004-006 (gpu-as-code, global-infra-modernisation, network-automation-fleet) were all
rendering the same generic pipeline thumbnail - added 3 tailored DossierThumb motifs (gpu die +
passthrough lanes, region globe, switch-fleet grid) via a new diagram: frontmatter field. Also
closed the dead-space gap above the tag row on short-argument cards with a faint on-theme grid
fill (::before, masked fade) instead of a flat void.

New post: broker-pattern ('An agent should never hold the key it's using') - SECURITY SERIES 02,
between secret-zero and workload-least-privilege. Hero de-watermarked from the NAS source (resized
to the calibrated 1600x1073 coordinate space, Jacobi-diffused out the Nano Banana sparkle at its
known center) via scripts/dewatermark-broker-pattern.mjs (reusable for the next 3 drafts). New
diagram/broker-pattern.svg in the house light-card palette. Inline top-of-body hero stripped per
the astro-static-site skill guard (frontmatter hero: is now the only render path).

src/data/series.ts

@@ -2,6 +2,6 @@
 // The security series threads the zero-trust arc across posts as they publish.
 export const series: Record<string, { name: string; number: number }> = {
   "secret-zero": { name: "SECURITY SERIES", number: 1 },
+  "broker-pattern": { name: "SECURITY SERIES", number: 2 },
   "workload-least-privilege": { name: "SECURITY SERIES", number: 3 },
-  // broker-pattern → 02 when it publishes (currently a draft in the workshop)
 };