Prepare public repository privacy and trusted runner gates

docs/deployment/GITEA_CD.md

@@ -9,8 +9,8 @@ host bind/port. SQLite/images/generated/cache live under `/data`; accounts,
 vendor sessions and configuration live under `/config`. Neither is disposable.
 The optional photos mount is read-only and has supplementary group access.
 
-Historical repository receipts mention `/volume2/docker/pigway-frame-flow/data`,
-`/volume2/docker/pigway-frame-flow/config`, `/volume1/photo`, port 18787, and
+Historical repository receipts mention `/volume1/docker/pigway-frame-flow/data`,
+`/volume1/docker/pigway-frame-flow/config`, `/volume1/photo`, port 18787, and
 container/project `pigway-frame-flow`. These are **confirmation candidates**, not
 script defaults. The deploy action accepts only explicitly configured paths
 that match the existing running container on the Runner's Docker daemon.
@@ -24,7 +24,7 @@ configured names and existing bind mounts, with `create_host_path: false`.
 
 ## Gitea configuration
 
-Repository Settings → Actions → Variables (ordinary configuration):
+Repository Settings → Actions configuration (private paths/addresses use Secrets):
 
 | Variable | Value to explicitly confirm |
 | --- | --- |
@@ -75,7 +75,7 @@ Never upload that journal or a full Docker inspect as a public CI artifact.
    docker inspect pigway-frame-flow --format '{{json .Mounts}}'
    docker inspect pigway-frame-flow --format '{{json .HostConfig.PortBindings}} {{.HostConfig.NetworkMode}}'
    ```
-   Confirm the Variables against these actual values, including photos.
+   Confirm the Variables/Secrets against these actual values, including photos.
 2. Configure the Secret privately. Keep `PROD_DEPLOY_ENABLED=false`.
 3. Manually run **Verify Frame Flow** on `main`, `deploy_action=plan`.
    Verify must pass first. Plan checks resource identity, paths/port, required
@@ -174,15 +174,15 @@ The confirmed NAS residue is a `created`, never-started container with dead
 `/workspace/way/...` bind paths. It is not an adoption/rollback baseline.
 No migration from those paths is performed. Production Compose remains independently usable.
 
-Set these repository Actions **Variables** (not Secrets):
+Set the ordinary repository Actions Variables below; set paths and addresses as Secrets (see docs/PUBLICATION.md):
 
 ```text
 PROD_DEPLOY_ENABLED=true
 PROD_PROJECT=pigway-frame-flow
 PROD_CONTAINER=pigway-frame-flow
 PROD_IMAGE_REPO=pigway-frame-flow
-PROD_DATA_DIR=/volume2/docker/pigway-frame-flow/data
-PROD_CONFIG_DIR=/volume2/docker/pigway-frame-flow/config
+PROD_DATA_DIR=/volume1/docker/pigway-frame-flow/data
+PROD_CONFIG_DIR=/volume1/docker/pigway-frame-flow/config
 PROD_WEB_BIND=192.0.2.10
 PROD_WEB_PORT=18787
 PROD_STATE_VOLUME=pigway-frame-flow-cd-state
@@ -262,7 +262,7 @@ as an Actions artifact. First bootstrap has no prior healthy version to roll bac
    No NAS bootstrap is executed merely by committing this implementation.
 3. Require `BOOTSTRAP VERIFIED` in the deploy log. In Container Manager confirm
    container `pigway-frame-flow` is running/healthy, user 10333, restart unless-stopped,
-   exact `/volume2/docker/pigway-frame-flow/{data,config}` mounts and
+   exact `/volume1/docker/pigway-frame-flow/{data,config}` mounts and
    `192.0.2.10:18787` binding (not loopback).
 4. Open `http://192.0.2.10:18787/api/v1/version`; its `commit` must equal the full
    workflow checkout commit. Check `/ready` returns HTTP 200. The immutable image tag
@@ -305,7 +305,7 @@ not every possible external download. No Runner or NAS network configuration is
 ### Synology Photos dependencies
 
 For a production photo source using Synology Photos person filtering, configure
-`SYNOLOGY_PHOTOS_URL` and `SYNOLOGY_PHOTOS_CERT_SHA256` as Gitea Variables. The
+`SYNOLOGY_PHOTOS_URL` and `SYNOLOGY_PHOTOS_CERT_SHA256` as Gitea Secrets. The
 certificate fingerprint must match the configured HTTPS endpoint. Keep the Photos
 session in the persistent `/config` directory; never put session credentials in
 Variables or repository files.