docs: add recipes section and artifacts configuration reference

[bryantbiggs]

Summary

PR 4 of the tag-filter + artifacts rollout. Pure docs — no code touched. Surfaces existing knobs as named patterns so users can find them without reading the configuration reference end to end.

• Adds a Recipes top-level section with seven pages: production-mirror, minimum-bytes, pin-literals-only, helm-chart-and-images, variant-filtering, semver-tracking, single-architecture.
• Adds an Artifacts configuration section (enabled / include / exclude / require_artifacts) with rationale for default-on.
• Adds a dual quickstart to README.md distinguishing full-fidelity from minimum-bytes, and surfaces the bit-for-bit framing in the tagline.
• The single-architecture recipe lives behind a prominent warning header documenting digest divergence, broken cosign verify, and arm64-consumer failure — the only ocync recipe that opts out of bit-for-bit.

Multi-arch is preserved in every standard recipe. The platforms: filter is documented as the single existing exception to bit-for-bit and isolated to the advanced recipe.

Linked: #80 (registry URL rewriting investigation, referenced from helm-chart-and-images).

Test plan

• npm run --prefix docs build — 28 pages built, no errors
• All seven recipe pages render at expected paths under /recipes/
• Cross-page links use root-absolute slugs per docs/CLAUDE.md convention
• Astro nav (top header + sidebar) shows the new "Recipes" tab and links
• Manual: load npm run --prefix docs preview and click through the dual quickstart and one recipe
• Manual: confirm gh-pages deploy renders correctly under the /ocync/ base path