blog: add secret-zero bootstrap diagram; clean up hero images

- Add the secret-zero bootstrap-chain diagram (was a broken image ref)
- Remove the corner sparkle artifact from all six blog hero images
- Bump hero/diagram cache-bust params so the updated assets serve

src/components/PostList.astro

@@ -16,7 +16,7 @@ const { posts } = Astro.props;
         <a class="post__link" href={`/blog/${post.id}/`}>
           {post.data.hero && (
             <div class="post__thumb">
-              <img src={`${post.data.hero}?v=1`} alt="" width="1600" height="1073" loading="lazy" decoding="async" />
+              <img src={`${post.data.hero}?v=2`} alt="" width="1600" height="1073" loading="lazy" decoding="async" />
             </div>
           )}
           <div class="post__card-body">

src/content/blog/secret-zero.md

@@ -41,7 +41,7 @@ From there the dam breaks in the good way: every app's `ExternalSecret` resolves
 the `Secret` in sync, and your repo stays a map of *names*, not values.
 
 <!-- DIAGRAM: secret-zero bootstrap chain — out-of-band identity → ClusterSecretStore → ExternalSecrets → app Secrets -->
-![Secret-zero bootstrap chain](/diagrams/secret-zero.svg)
+![Secret-zero bootstrap chain](/diagrams/secret-zero.svg?v=1)
 
 ## The discipline around the one exception
 

src/pages/blog/[slug].astro

@@ -36,7 +36,7 @@ const { Content } = await render(entry);
       {entry.data.hero && (
         <figure class="post__hero" data-reveal>
           <img
-            src={`${entry.data.hero}?v=1`}
+            src={`${entry.data.hero}?v=2`}
             alt={entry.data.heroAlt ?? entry.data.title}
             width="1600"
             height="1073"