deploy: nginx and git-sync, no image built

Serves loom.hypertheory-labs.dev from the site branch, which holds dist/ and
nothing else. Two public images; git-sync polls the branch and nginx serves the
volume, so publishing a new version is a push and there is no rollout.

This sidesteps the cluster's open gap on publishing container images rather than
closing it. The first workload that genuinely needs an image we built still hits
it, and nothing here is evidence the gap is smaller than it looked.

The HTTPRoute carries no hostname of its own, per public-access.md: it pins to
the loom listener by sectionName and inherits. A route with its own hostnames
stops inheriting and stops being portable between staging and production.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

deploy/nginx-conf.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: docs-nginx
+  namespace: loom
+data:
+  default.conf: |
+    server {
+      listen 8080;
+      # git-sync keeps `current` pointed at the checked-out worktree, so this
+      # path follows a new commit without nginx restarting.
+      root /site/current/dist;
+      index index.html;
+
+      # Astro emits directory-style URLs: /bedrock/starting/ -> .../index.html
+      location / {
+        try_files $uri $uri/ $uri/index.html =404;
+      }
+
+      # Hashed assets are immutable; pages are not, and a cached page is how a
+      # corrected document keeps reading as true.
+      location /_astro/ {
+        add_header Cache-Control "public, max-age=31536000, immutable";
+      }
+
+      error_page 404 /404.html;
+    }