Conventions

Area	Convention
Stack ownership	One stack repo under `Charlie/` per deployed service group.
Deploy entrypoint	`.gitea/workflows/deploy.yaml` calls this repo's shared deploy workflow.
Host selection	Workflow `host` input; not runner labels.
Working tree	`/mnt/nas/stacks/<stack>` is reset to the repo state on deploy.
Runtime data	`/mnt/nas/data/<stack>` only; never inside the git working tree.
Secrets	SOPS files under `secrets/`; plaintext ignored and deploy-time only.
Images	Compose pins concrete tags or digests. No `:latest` in stack repos.