blog: hero images + publish secret-zero

Add an optional hero field to the blog schema; render it on the post page and
as the index card thumbnail. Ship 4 verified Nano Banana hero images (shipping/
init-gating/authentik/workload) as optimized webp (64-134KB). Publish the
secret-zero post. (outbound hero pending — its file was a dup of shipping;
secret-zero hero pending generation.)

src/content.config.ts

@@ -33,6 +33,9 @@ const blog = defineCollection({
     summary: z.string(),
     tags: z.array(z.string()).default([]),
     draft: z.boolean().default(false),
+    // Optional hero image — a /blog/<slug>.webp in public/. Rendered on the post + as the card thumbnail.
+    hero: z.string().optional(),
+    heroAlt: z.string().optional(),
   }),
 });