feat(static-sites): add scoped Bunny purge gateway

README.md

@@ -37,6 +37,7 @@ jobs:
         with:
           directory: dist
           storage-zone: example-org
+          purge-endpoint: https://tionis-static-site-purge.bunny.run
         env:
           BUNNY_STORAGE_PASSWORD: ${{ secrets.BUNNY_STORAGE_PASSWORD }}
 ```
@@ -44,6 +45,12 @@ jobs:
 Only run deployments for trusted branches. A contributor able to change a
 workflow that receives production secrets can attempt to expose those secrets.
 
+`purge-endpoint` is optional. The Gandalf-managed gateway reuses the dedicated
+Storage Zone password to authorize purging only Pull Zones linked to that
+allowlisted zone. It avoids exposing the account-wide Bunny API key to project
+repositories. A configured purge is attempted after every non-dry-run sync,
+including a retry where Storage already matches the local build.
+
 ## Command line
 
 The script can also be used directly with Python 3.11 or newer: