gitea: leave webhook registration operator-managed

README.md

@@ -43,7 +43,7 @@ Mars includes a small HMAC-validating relay for Gitea webhooks. It forwards the
 authenticated request body unchanged, along with Gitea event and delivery
 headers, to Hermes over localhost. The relay has no event, repository, action,
 payload, or prompt policy; Hermes owns interpretation and response behavior.
-Jupiter's Gitea provisioning service registers the webhook idempotently at
+Add the Gitea repository webhook manually with target URL
 `http://mars.orbit.sol:8645/gitea`.
 
 Hermes separately subscribes to `pull_request_comment` and
@@ -52,10 +52,10 @@ pull requests not authored by `luna`, then handles external comments in the
 pull request using Tea/Gitea. This route policy is intentionally outside the
 relay.
 
-Before deploying either host, add the same random
-`gitea_hermes_webhook_secret` value to both `secrets/mars.yaml` and
-`secrets/jupiter.yaml` with `sops --set`. The value is intentionally not
-included in the repository.
+Before deploying Mars, add a random `gitea_hermes_webhook_secret` value to
+`secrets/mars.yaml` with `sops --set`. Use that same value when manually
+creating the Gitea webhook. The value is intentionally not included in the
+repository.
 
 ## Test in VirtualBox (no hardware needed)