docs: state the Gitea repo structure and SSH push auth in the README and every scenario root

One Gitea repo (kai/pi-agent-config, SSH key auth as user git on :222) holds the runtime config, all scenario agent configs, and the curator backend; no per-agent repos. Each scenario now carries a root README pointing at the shared repo and push flow so a directory's provenance and push method are unambiguous.

README.md

@@ -10,6 +10,46 @@ record what a running service already does.
 
 Verified against **pi 0.84.3**. Re-run the probes after every `pi update`.
 
+## Gitea repository and push authentication
+
+Everything here — the runtime config, every scenario's agent config, and (for
+scenarios that run a service) the application backend — lives in a single Gitea
+repository: **`kai/pi-agent-config`** on the server at `192.168.50.45` (web UI on
+`:3000`, SSH on `:222`). There is no per-agent repository; a Pi agent is a
+directory under `scenarios/`, not a separate repo.
+
+Push and pull over **SSH key auth only** (no HTTP token). The Git user is `git`,
+not `kai`. `~/.ssh/config`:
+
+```bash
+Host gitea-45
+    HostName 192.168.50.45
+    User git
+    Port 222
+    IdentityFile ~/.ssh/id_ed25519_gitea
+    IdentitiesOnly yes
+```
+
+The remote is `origin -> gitea-45:kai/pi-agent-config.git` (branch `main`). Run
+Git from the repository root, never from a scenario subdirectory that might carry
+a different remote:
+
+```bash
+git pull --rebase origin main
+git push origin main
+```
+
+Verify access:
+
+```bash
+ssh -T gitea-45                             # "Hi there, kai! ... authenticated"
+git ls-remote gitea-45:kai/pi-agent-config.git
+```
+
+- The key file must be `0600`; never read or print its contents.
+- `gitea-pve`, if present in your SSH config, is a host login — not a Git remote.
+- The `verify-no-secrets.sh` pre-commit hook must pass; never use `--no-verify`.
+
 ## Scenarios
 
 | Scenario | Purpose | Service | Status |