G2.3: Windy Git branding — and get it out of one host's disk into the repo

The front end was 100% stock Gitea: green teacup, "Gitea: Git with a cup of
tea", "A painless, self-hosted Git service". G2.3 was specified in the plan with
an acceptance test and never executed, and nothing enforced it.

Now: Windy Git name, wind-mark logo, brand-blue accent, and a landing page that
says what this actually is. Uses Gitea's SUPPORTED surface (custom templates +
public assets) so upstream upgrades keep arriving — no source modified (D-2/I-1).

Two traps this cost, both now documented and tested:

1. GITEA__DEFAULT__APP_NAME does not work. Gitea reads APP_NAME from the TOP
   LEVEL of app.ini; the env var created a literal [default] section that Gitea
   ignores, so the installer's stock APP_NAME kept winning while the config
   looked correct. The env-to-ini pass also APPENDED a second APP_NAME rather
   than replacing the first — a new variant of the documented G4A.3 trap.

2. Cloudflare caches /assets/* for 6h and no token in this stack can purge, so
   the new logo and CSS were invisible while being correct at origin. Brand
   assets now carry a VERSION IN THE FILENAME; bump it on every change.

Committed with an idempotent apply.sh, because applying it straight to Veron's
disk first was itself the config-drift trap this project documents: a rebuild
would have silently reverted to stock Gitea.

85 tests green.

Co-Authored-By: Claude (Fable 5) <noreply@anthropic.com>

deploy/branding/templates/home.tmpl

@@ -0,0 +1,27 @@
+{{template "base/head" .}}
+<div role="main" aria-label="{{ctx.Locale.Tr "home"}}" class="page-content home">
+  <div class="wg-hero">
+    <img src="{{AssetUrlPrefix}}/img/logo.svg" alt="Windy Git" width="72" height="72">
+    <h1>Windy Git</h1>
+    <p class="wg-sub">Your work, every version — and agents as citizens.</p>
+    <div class="wg-cta">
+      {{if not .IsSigned}}
+        <a class="ui primary button" href="{{AppSubUrl}}/user/login">Sign in with Windy</a>
+      {{else}}
+        <a class="ui primary button" href="{{AppSubUrl}}/{{.SignedUser.Name}}?tab=repositories">Your repositories</a>
+      {{end}}
+      <a class="ui button" href="{{AppSubUrl}}/explore/repos">Explore</a>
+    </div>
+  </div>
+  <div class="wg-grid">
+    <div class="wg-card"><h3>Code and models, one host</h3>
+      <p>Git and LFS over Windy Cloud storage. Source, weights and adapters live side by side.</p></div>
+    <div class="wg-card"><h3>Agents are first-class</h3>
+      <p>An agent signs in with its own Eternitas passport — not a human's borrowed token — and its work is attributable to it.</p></div>
+    <div class="wg-card"><h3>Your account, no second password</h3>
+      <p>Sign in with the Windy account you already have. Nothing new to remember.</p></div>
+    <div class="wg-card"><h3>Kept, and kept elsewhere</h3>
+      <p>Every repository is bundled nightly to off-site storage, and the restore is rehearsed rather than assumed.</p></div>
+  </div>
+</div>
+{{template "base/footer" .}}