blog: hero images + publish secret-zero

Add an optional hero field to the blog schema; render it on the post page and
as the index card thumbnail. Ship 4 verified Nano Banana hero images (shipping/
init-gating/authentik/workload) as optimized webp (64-134KB). Publish the
secret-zero post. (outbound hero pending — its file was a dup of shipping;
secret-zero hero pending generation.)

src/content/blog/shipping-this-site.md

@@ -3,6 +3,9 @@ title: "Shipping this site: GitOps from a homelab to the public internet"
 date: 2026-06-15
 summary: "How this portfolio is built and served — Astro to a container image, a self-hosted Gitea registry, ArgoCD, and a Cloudflare Tunnel — with security as acceptance criteria, not polish."
 tags: ["gitops", "astro", "homelab", "security"]
+hero: "/blog/shipping-this-site.webp"
+heroAlt: "A glowing data container travels a luminous rail from a small server rack toward a softly glowing globe of Earth, wrapped by a reconcile loop."
+
 ---
 
 This site is a static Astro build, but how it gets to you is the interesting part. It's