docs: record what the alias push actually costs — zero layer bytes (4311)

The comment said the first run would answer whether the registry shares
blobs across two repositories of one owner. Run 7300 answered it: every
layer came back "Layer already exists" or "Mounted from
bvandeusen/fabledcurator". The push moves a manifest and nothing else.

22 seconds, against the ~2 minutes the duplicate build cost (run 7282:
build-ml 1m55s for output identical to build-web's).

Also noted: the pushed manifest gets its own digest, because docker
re-serialises it — same layers, same config, same fc.revision, different
manifest bytes. Nothing compares the two, but the digests differing is the
first thing someone will notice and misread as a second build still
happening.

Leaving a "we do not know yet" in the file once the run has said would make
it the kind of stale note that misleads the next person to read it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LVjrnpQjRgHdvq95rASoiR

.forgejo/workflows/build.yml

@@ -1718,12 +1718,19 @@ jobs:
           # ONLY, so an index sitting at :refresh-candidate would fail its
           # `test -n "$CT"` and break the weekly refresh for this name.
           #
-          # The layers were just built on this runner pool, so the pull is
-          # normally local. The push sends only blobs the destination lacks —
-          # whether the registry shares them across two repositories of one
-          # owner is not something this file should assume, and the first run's
-          # output answers it. Either way it moves no more bytes than the
-          # duplicate build's own push did, and it compiles nothing.
+          # MEASURED on run 7300, the first execution: the push moved ZERO
+          # layer bytes. Every blob came back either "Layer already exists" or
+          # "Mounted from bvandeusen/fabledcurator" — the registry does
+          # cross-repository blob mounts between two repos of one owner, so
+          # this copies a manifest and nothing else. 22s, against the ~2min
+          # the duplicate build cost (run 7282: build-ml 1m55s).
+          #
+          # The pushed manifest gets its OWN digest (b979b145… where the
+          # source was aca4c75…) because docker re-serialises it. Same layers,
+          # same config, same fc.revision; only the manifest bytes differ.
+          # Nothing compares the two, and promote reads whatever is at the tag
+          # — but it is worth saying, because the digests looking different is
+          # the first thing someone will notice and misread as a second build.
           docker pull "$SRC@$DIGEST"
           for t in $TAGS; do
             echo "alias: $DST:$t -> $SRC@$DIGEST"