blog: hero images + publish secret-zero

Add an optional hero field to the blog schema; render it on the post page and
as the index card thumbnail. Ship 4 verified Nano Banana hero images (shipping/
init-gating/authentik/workload) as optimized webp (64-134KB). Publish the
secret-zero post. (outbound hero pending — its file was a dup of shipping;
secret-zero hero pending generation.)

src/content/blog/workload-least-privilege.md

@@ -4,6 +4,9 @@ date: 2026-06-23
 summary: "Least privilege for Kubernetes workloads doesn't start with an RBAC role — it starts with revoking the API token every pod silently carries, then layering identity, non-root, and Pod Security on top."
 tags: ["kubernetes", "security", "least-privilege", "rbac", "service-accounts"]
 draft: false
+hero: "/blog/workload-least-privilege.webp"
+heroAlt: "Rows of glowing cube-pods each clutch a keycard, facing a sealed vault door none of them open; one keycard dissolves into particles, revoked."
+
 ---
 
 Open a shell in almost any Kubernetes pod and look in `/var/run/secrets/kubernetes.io`. There's a token