- Gitea Actions workflow: build, push sha-tagged image, apply kustomize, wait for rollout with auto-rollback - Deploy to personal-site namespace, served at jesseinit.dev with TLS - Run container as non-root and bind to 0.0.0.0 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>