README: describe the JS that actually ships instead of claiming zero, and note why the site still works with JS disabled

README.md

@@ -11,7 +11,10 @@ by default.
 ## Stack
 
 - Astro (static output), TypeScript, Tailwind v4
-- Zero JS by default; small islands for the theme toggle and scroll reveals
+- Static output with one self-hosted client bundle (~74 KB: Motion for scroll reveals, plus a
+  small pre-paint theme script). No inline script anywhere, so `script-src 'self'` holds.
+- Content is visible with JavaScript disabled: reveal styles are gated behind an `html.js`
+  class the script adds, and `prefers-reduced-motion` forces the visible state
 - Content and config are data-driven (`src/data/`, `src/content/`) - adding a
   post or project never touches a component
 
@@ -62,7 +65,7 @@ SBOM (CycloneDX) -> buildah build+push -> open a digest-bump PR to home-ops
 ```
 
 The PR is never auto-merged - the deploy repo's `main` is branch-protected, and
-merging the PR is what triggers the ArgoCD rollout. The runner holds
+merging the PR is what triggers the Argo CD rollout. The runner holds
 least-privilege credentials only: a scoped deploy key, a PR token, and a
 registry push token.
 
@@ -75,5 +78,5 @@ registry push token.
 
 Built into a container image, served by nginx-unprivileged on Kubernetes,
 exposed outbound-only via Cloudflare Tunnel. The image is pinned by digest in
-the private deploy repo and rolled out by ArgoCD. Manual bootstrap build:
+the private deploy repo and rolled out by Argo CD. Manual bootstrap build:
 `scripts/build-image.sh push`. Full posture in `SECURITY.md`.