supply chain: tiered mirrors (central cloud mirror -> site mirrors) in prose, ledger card and blueprint

pilot/arc.tpl.html

@@ -237,6 +237,13 @@
       image mirror rules, and carries a sharp edge: digest-mirror rules rewrite <b>digest pulls
       only</b>, so a by-tag pull silently skips the mirror. The pinning habit is what makes the
       mirror actually catch the traffic.</p>
+    <p>At real fleet scale the mirror itself tiers: a <b>central mirror in the cloud</b> fronts
+      upstream once, and every site's mirror pulls from the centre rather than from upstream
+      directly. A new image ripples outward in layers - upstream to the centre, centre to each
+      site as it asks, site to its nodes over the LAN - instead of every site hammering upstream
+      at the same moment. Upstream sees one consumer; each site sees one hop; the nodes never
+      leave the building.</p>
+    <p class="sayit">Mirrors tier: the load fans out in layers, never all at once.</p>
     <h3>Build once, promote by copy</h3>
     <p>Every rebuild is a different artefact - different digest, untested by the stages before it.
       So build <b>once</b>, then promote the same digest through environments by copying, registry
@@ -353,7 +360,8 @@
     <article class="card">
       <h3>zot</h3>
       <p class="what">Where the fleet pulls from - a pull-through mirror between the cluster and the
-        internet, and the control point for what enters.</p>
+        internet, and the control point for what enters. At fleet scale it tiers: one central
+        mirror in the cloud fans out to per-site mirrors, layering the load.</p>
       <p class="leans"><b>Leans on it:</b> every image pull on every node - boot, reschedule,
         scale-up, recovery.</p>
       <p class="down"><b>When it is down:</b> the sharpest edge. Upstream down + mirror up = nobody