docs(website): re-shoot the docs stills on the 0.69 UI, and make the rig reproducible

[edspencer]

Why

Every UI-bearing asset on the site was shot before the design work landed. The
seven stills merged in the previous pass predate the first design commit (67e493f)
by 41 minutes, so they are pre-redesign exactly like the older ones. Age was never the
criterion — three of these were a day old and still wrong, because of what landed
after they were committed.

These sit under prose in the present tense, on pages a reader consults to operate
the product. A pre-redesign frame there is worse than no image: a reader who cannot
find the pictured control concludes the docs are stale everywhere.

Re-shot — 7 stills

getting-started/root-home.png · config/project-settings.png ·
using/adopt-row.png · using/adopt-modal.png · using/adopted-badge.png ·
using/promote-to-project.png · guides/trigger-tool-picker-bash.png

All at v0.69.0 in Foundation / dark / hue: null / tint: 0 — the out-of-the-box
appearance (DEFAULT_APPEARANCE; paddock:theme defaults to dark). That is what a
reader sees on first boot, which is a docs screenshot's whole job.

Two alt-text corrections ride along, and they are not cosmetic — alt text is the
only description a screen-reader user gets. getting-started.md claimed four unread
chats and named OVERVIEW.MD/CHANGELOG.MD sections; the frame shows nine unread, three
projects grouped by area, and RUNNING/UNREAD/FILES.

Not here: the theme quartet and the Appearance panel

Those five stills live in #815, which also carries the 0.67 prose that references
them. Keeping a copy here would have made them orphans on this branch and put the same
bytes in two PRs. This branch has zero orphans and zero dangling references —
checked mechanically, both directions.

Making the rig reproducible

seed.mjs and serve.sh existed only on one machine and were full of its paths and
ports — so capture.mjs, which is committed, was unusable by anyone else. Both are
now committed, driven by four env vars (PADDOCK_RIG_HOME / _CLONE / _PROJECTS /
_BASE), with no box paths.

Worth reviewing rather than skimming:

• serve.sh was retyped from a spec, not copied. The original held a live OAuth
  token in plaintext; those lines are gone rather than edited. A rig running a fake
  claude must never need a credential.
• The projects root moved off /home. The previous rig kept it there on a box
  where only /data was a volume — a container restart destroyed every project.yaml
  and every .chats/*.jsonl while the data dir survived, leaving orphaned job records
  reporting chats whose transcripts were gone. Default is now $PADDOCK_RIG_HOME/projects.
• It binds loopback, not 0.0.0.0. With PADDOCK_AUTH_MODE=none, binding all
  interfaces publishes an unauthenticated instance. Capture runs on the same host, so
  PADDOCK_DANGEROUSLY_ALLOW_OPEN is no longer needed at all.
• capture.mjs pins the theme via addInitScript and asserts it applied. It has
  to be addInitScript: the three paddock:* keys are read by a pre-paint inline
  script, so a page.evaluate after goto catches a mid-swap frame — and a stale
  paddock:appearance-cache paints the previous theme's accent for one frame.
• shots.manifest.json records the observed theme, accent, mode and app version
  beside every shot, so "which build is this frame from?" is a file read rather than
  the forensics that made this pass expensive.

Verification

• cd website && npm install && npm run build → exits 0, 52 pages.
• Leak check (CI has no secret scan — this is manual): exactly 46 127.0.0.1
  hits across website/src/content/docs/** + README.md, matching the recounted
  baseline. No private hostname, LAN IP, container id or box path in the diff.
• Rig identity proven from /api/instance-config (dataDir + driveMode: batch),
  never from pm status or /api/health — both are satisfied by a stale squatter.
• Stale-build guard: the rig was rebuilt at main and /config confirmed to
  render the Appearance section, which cannot exist before 75c3935. Without this
  every "re-shot" frame would be the old UI again, and nothing else would show it.
• md5sum on every shot — no byte-identical pairs. Two unframed shots of one URL
  at one viewport land as the same file.
• Every committed frame was opened and looked at. strings shot.png is not a leak
  check — rendered text is pixels.

Docs-only: no changeset, no version bump.

Not in this PR

• Video (accent picker, Discover). The harness is on the unmerged chore(video): move the video-production harness into the repo #584; not reached.
• Remaining P1/P2 re-shoots needing more fixtures (hooks, cron schedules, attachments),
  and the dual-use forks.
• docs/demo/paddock-demo.gif and its website/public/demo/ copy — owned by docs(demo): re-shoot the demo reel on main at v0.67.0 (supersedes #790) #797.

[cloudflare-workers-and-pages]

Deploying paddock with    Cloudflare Pages

Latest commit:	f60fe9d
Status:	✅  Deploy successful!
Preview URL:	https://e58fed9d.paddock-7u2.pages.dev
Branch Preview URL:	https://docs-media-v069.paddock-7u2.pages.dev

View logs

[edspencer]

Superseded by #829 (captures) and #830 (rig tooling + runbook), which split this into two independently reviewable changes and are a strict superset of it. Closing to keep the review queue honest — no content is lost.