Add preview-only Decap CMS pilot

docs/decap-cms-pilot.md

@@ -1,9 +1,10 @@
 # Decap CMS Gitea pilot
 
-Status: planned; no CMS, OAuth application, Gitea CORS change, branch
-protection, or deployment has been enabled by this document.
+Status: repository implementation prepared for review; no OAuth application,
+Gitea CORS change, branch protection, branch push, preview deployment, or
+production merge has been performed.
 
-Updated: 2026-09-03
+Updated: 2026-09-04
 
 ## Purpose
 
@@ -49,6 +50,39 @@ References:
 - <https://docs.gitea.com/usage/access-control/protected-branches/>
 - <https://github.com/decaporg/decap-cms/issues/7115>
 
+The exact, unapplied Gitea CORS, OAuth, and two-rule branch-protection settings
+are recorded in [Decap CMS pilot: unapplied Gitea settings](decap-cms-gitea-setup.md).
+
+## Repository implementation under review
+
+The `review/decap-cms-pilot` branch now contains the repository-side portion of
+the pilot:
+
+- `public/admin/` provides a permanently no-index admin shell and one shared
+  configuration for both site builds.
+- The shell pins Decap CMS `3.15.1` by exact URL and verified SHA-384 integrity
+  value rather than a floating release range.
+- The backend is fixed to `SloanOps/3031023-xyz` and `cms/pilot`. Its public
+  OAuth client ID remains an explicit placeholder until the separately
+  approved non-confidential Gitea application exists.
+- All four Markdown collections and every persisted frontmatter field are
+  modeled with the current Astro/Zod bounds. Markdown controls are text-first;
+  image embedding and general file widgets are absent.
+- The team image field accepts an existing approved raster path or a bounded
+  upload. URL insertion and SVG paths are rejected. Builds additionally verify
+  the extension, raster signature, flat upload path, and 500 KiB limit.
+- `.gitea/workflows/cms-content-validation.yml` runs on every pull request into
+  `main`, uses no secrets, and reports
+  `CMS content validation / cms-content-validation (pull_request)` after
+  checking the Decap contract and building and verifying both sites.
+- The existing branch preview workflows remain in place. Local output checks
+  now prove preview robots rules and page metadata stay no-index and that the
+  admin response has a no-index header rule.
+
+This preparation does not make the CMS usable yet: the placeholder public
+client ID, unapplied CORS setting, absent `cms/pilot` remote branch, and absent
+branch rules are intentional review gates.
+
 ## Proposed pilot architecture
 
 ```text
@@ -192,8 +226,8 @@ request in Gitea. After an approved merge, synchronize the CMS branch with
    Allow only required methods and headers, including `Authorization` and
    `Content-Type`; do not use a wildcard origin.
 3. Create `cms/pilot` from the reviewed repository baseline.
-4. Add pinned Decap admin assets beneath `public/admin/`. Do not load a floating
-   major-version range from a CDN.
+4. Review the pinned Decap admin assets beneath `public/admin/`. Do not replace
+   the exact version and integrity value with a floating range.
 5. Configure the Gitea backend for `SloanOps/3031023-xyz` and branch
    `cms/pilot`.
 6. Model every persisted frontmatter field with limits matching