Previously this site had no CI at all — deploys went through a
forced-command SSH key that ran a fixed script cloning the repo and
building on the production host directly. Now CI builds the site in
an isolated container and pushes the output via rsync to a
forced-command key restricted (via rrsync) to this site's own docroot
only, matching the pattern now used across all the other Hugo sites.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
will