ci: fix manual checkout writing to nonexistent /tmp in kaniko image

/tmp doesn't exist in the kaniko executor:debug image (confirmed - no
standard FHS layout there at all), so the wget -O target failed with
"No such file or directory". Write into github.workspace instead, which
is known to exist since the build step already uses it.

Also adds the step-7 desktop-vs-k8s clarification from earlier.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Y4YNpuC2bgT224suQLLJ7B

.forgejo/workflows/build-hello-app.yml

@@ -23,10 +23,10 @@ jobs:
       - name: Checkout (manual - no git/node in this image)
         run: |
           wget --header="Authorization: token ${{ secrets.FORGEJO_TOKEN }}" \
-            -O /tmp/source.tar.gz \
+            -O "${{ github.workspace }}/source.tar.gz" \
             "https://git.boglabob.com/${{ github.repository }}/archive/${{ github.sha }}.tar.gz"
-          tar -xzf /tmp/source.tar.gz --strip-components=1 -C "${{ github.workspace }}"
-          rm /tmp/source.tar.gz
+          tar -xzf "${{ github.workspace }}/source.tar.gz" --strip-components=1 -C "${{ github.workspace }}"
+          rm "${{ github.workspace }}/source.tar.gz"
 
       - name: Write registry auth
         run: |

docs/03-flux.md

@@ -404,7 +404,12 @@ publishes a new image and roll it out — that's
 (`ImageRepository`/`ImagePolicy`/`ImageUpdateAutomation`, all commented in
 that file).
 
-Exercise the whole loop end to end:
+Exercise the whole loop end to end. Unlike the rest of this stage, this
+runs on your **desktop** (the `maq` clone from `docs/01-bootstrap.md` step
+4), not as `k8s` on the T630 — `k8s`'s own git access (`k8s-readonly`) is
+read-only by design, so it can't push. Once pushed, Forgejo Actions picks
+it up on its own self-hosted runner automatically; you don't need to be on
+the T630 for any of this step:
 
 ```sh
 sed -i 's/This page is served from it\./This page is served from it — and this line proves it: edited via git push./' apps/hello-app/src/index.html