docs(github): explain where a push gets its secrets, and release ownership

[jona62]

A push to a GitHub connection deploys in Rigbox. It resolves secrets: from the connection's encrypted runtime secrets, never from .env, and the docs didn't say so. Two problems followed:

• values that worked locally were silently missing on pushes;
• a refused rig deploy ("belongs to another active deployment") left users guessing.

These are the docs for jona62/rig-mvp#484 and for the secrets handoff in rigbox-dev/cli#201.

What changes

• guides/github.mdx gains a Runtime secrets section. It covers:
  • what a push reads, and how name, from and optional resolve there;
  • what happens when a required or an optional secret is missing;
  • setting values in the console or with rig deploy, and adding a new secret;
  • checking which declared secrets have a value, with rig ci status.
• configure/secrets.mdx gains a "Where values come from" table for each way of deploying.
• deploy/release-ownership.mdx is a new page. It covers:
  • the three kinds of owner: a local project, a GitHub connection and an Actions binding;
  • who can take an app over from each;
  • what the refusal says, and what rig deploy then does with its secrets;
  • how to move apps to a GitHub connection and back.
  • The page is linked from the GitHub guide, the secrets page, multi-app, and deployment troubleshooting, and it is in the navigation.
• The docs say which paths require a secret to be declared first. rig deploy and the API refuse names that the connected branch doesn't declare. The console stores whatever it is given.

Before merging

• Merge after jona62/rig-mvp#484 is deployed and rigbox-dev/cli#201 is released.
• cli-reference/commands/ci/status.mdx still describes the old rig ci status. The next real CLI export picks up the connection and secrets listing (see docs: describe SSH that sets itself up and the CLI inside a workspace #22).
• check-docs.py, build-navigation.py --check and generate-cli-reference.py --check pass. The branch merges cleanly with docs: describe SSH that sets itself up and the CLI inside a workspace #22.

🤖 Generated with Claude Code