Publish Packwiz site as immutable image

.gitea/README.md

@@ -43,6 +43,10 @@ https://mc.ahmza.com/playground/dev/pack.toml
 mc-modpacks/
 ├── .gitea/
 │   └── workflows/
+├── scripts/
+│   └── build-site.sh
+├── Dockerfile
+├── sws.toml
 ├── forever/
 │   ├── pack.toml
 │   ├── index.toml
@@ -168,6 +172,24 @@ Packwiz is responsible for modpack contents and side filtering.
 Pterodactyl is responsible for Java, server process management and resources.
 
 Kubernetes/SWS provides static hosting for the published Packwiz repositories.
+The publishing workflow runs [`scripts/build-site.sh`](../scripts/build-site.sh),
+which exports committed Git revisions into the documented URL layout, then
+builds the multi-architecture image
+`tea.ahmza.com/ahmza/mcpacks-site`.
+
+The workflow finally commits that image's immutable OCI digest to
+`apps/mcpacks/deployment.yaml` in the `ahmza/k8s-starter-pack` repository.
+Argo CD notices that commit and performs the rollout; the workflow does not
+hold Kubernetes credentials or change the cluster directly.
+
+The Gitea Actions repository secret `GITEATOKEN` must be able to:
+
+- push packages owned by `ahmza`
+- read and write `ahmza/k8s-starter-pack`
+
+The `latest` image tag exists only to bootstrap the first Argo CD sync and for
+human inspection. Normal rollouts use the exact content digest recorded in the
+GitOps manifest, making the running version auditable and rollback-friendly.
 
 ## Rollback