docs(image-automation): push identity is the flux account, not gitea_admin

The comment on ImageUpdateAutomation/homelab named gitea_admin as the
owner of the bootstrap token that pushes writeback commits to master.
That is wrong. The pushing account is `flux` (Gitea uid 9): its
contribution history matches every `chore(image-automation)` commit on
master 1:1, while gitea_admin's own contributions stop at 2026-07-21.

Also separates two things the old wording ran together — the commit
author (security-bot@renner.uno, set in this spec) and the pushing
account (the token owner, not set here) — and records that writeback
failure is silent, since no commit is attempted unless a tracked image
moves.

Comment-only. The ImageUpdateAutomation object is byte-identical; no
Kubernetes object changes, nothing for Flux to reconcile.

Refs REN-50

Co-Authored-By: Paperclip <noreply@paperclip.ing>

kubernetes/infrastructure/image-automation/update-automation.yaml

@@ -8,8 +8,15 @@ spec:
   # Reuses the existing flux-system GitRepository — its Secret was
   # created by `flux bootstrap gitea --token-auth` and already has
   # write access to the repo. Push identity is the bootstrap token's
-  # owner (gitea_admin); commit author is overridden below to
-  # security-bot@renner.uno so commits stay visibly machine-authored.
+  # owner, which is the `flux` Gitea account (uid 9) — not
+  # gitea_admin, as this comment used to say. Evidence: the flux
+  # account's contribution history matches every
+  # `chore(image-automation)` commit on master 1:1, while
+  # gitea_admin's own contributions stop at 2026-07-21. That account
+  # therefore has to keep push access to master, or writeback fails
+  # silently — no commit is attempted unless a tracked image moves.
+  # The commit author overridden below to security-bot@renner.uno is
+  # the author field only; it says nothing about who pushes.
   sourceRef:
     kind: GitRepository
     name: flux-system