Updated project to improve guidance

apps/hello-app/deployment.yaml

@@ -1,3 +1,7 @@
+# This app's own Deployment/Service/Ingress, hand-written rather than a
+# Helm chart (see README.md "Why it's structured this way") — there's no
+# upstream chart to track since the image is built by this repo's own CI
+# (.forgejo/workflows/build-hello-app.yml).
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -14,11 +18,16 @@ spec:
         app: hello-app
     spec:
       # Uncomment if the hello-app package is set to private in Forgejo
-      # (see docs/SETUP.md step 9).
+      # (see docs/03-flux.md step 6).
       # imagePullSecrets:
       #   - name: forgejo-registry
       containers:
         - name: hello-app
+          # Not a comment — this exact-format annotation is how Flux's
+          # image-automation "Setters" strategy (image-automation.yaml's
+          # ImageUpdateAutomation) finds this line and knows to rewrite the
+          # tag below in place, rather than needing this field templated.
+          # "hello-app:hello-app" is "<namespace>:<ImagePolicy name>".
           # {"$imagepolicy": "hello-app:hello-app"}
           image: git.boglabob.com/codegit/hello-app:latest
           ports: