blog: add outbound + secret-zero hero images

outbound-only-exposure (corrected sealed-vault image) + secret-zero (the seed-
key circuit-tree, _R revision). Both verified against their prompts, optimized
to webp (17KB / ~120KB). Completes hero coverage for all 6 posts.

src/content/blog/secret-zero.md

@@ -4,6 +4,9 @@ date: 2026-06-28
 summary: "Secrets management has a bootstrap paradox: the credential that pulls every other secret can't itself live in git. Here's how a homelab fleet breaks the cycle — zero plaintext secrets in any repo, and a clean rule for which is the one exception."
 tags: ["security", "gitops", "secrets", "kubernetes", "external-secrets"]
 draft: false
+hero: "/blog/secret-zero.webp"
+heroAlt: "A single glowing seed-shaped key at the base of a dark circuit-board tree whose traces branch upward into hundreds of faint nodes, all drawing their glow from that one source."
+
 ---
 
 ![A single glowing seed-key at the root of a circuit-board tree](/blog/secret-zero.webp)