deploy: nginx and git-sync, no image built

Serves loom.hypertheory-labs.dev from the site branch, which holds dist/ and
nothing else. Two public images; git-sync polls the branch and nginx serves the
volume, so publishing a new version is a push and there is no rollout.

This sidesteps the cluster's open gap on publishing container images rather than
closing it. The first workload that genuinely needs an image we built still hits
it, and nothing here is evidence the gap is smaller than it looked.

The HTTPRoute carries no hostname of its own, per public-access.md: it pins to
the loom listener by sectionName and inherits. A route with its own hostnames
stops inheriting and stops being portable between staging and production.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/publish-site.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Put dist/ on the `site` branch, which holds build output and nothing else.
+# git-sync follows that branch; there is no image and no rollout.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+[ -d dist ] || { echo "no dist/ — run npm run build first" >&2; exit 1; }
+SHA=$(git rev-parse --short HEAD)
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+git worktree add -q --detach "$WORK"
+cd "$WORK"
+git checkout -q --orphan site
+git rm -rq --cached . 2>/dev/null || true
+find . -mindepth 1 -maxdepth 1 ! -name .git -exec rm -rf {} +
+mkdir dist && cp -R "$OLDPWD/dist/." dist/
+git add -A
+git commit -q -m "site: built from $SHA"
+git push -qf origin site
+cd "$OLDPWD"
+git worktree remove --force "$WORK"
+echo "published site branch from $SHA"