fix(ghost-en): stage redirects via initContainer, not read-only mount

A ConfigMap volume is read-only at the FS level, so the Ghost entrypoint's
chown -R on content/ failed ("Read-only file system") and crash-looped.
Copy redirects.yaml onto the writable PVC with an initContainer instead;
still GitOps-sourced and refreshed on every pod start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ghost-en/deployment.yaml

@@ -41,6 +41,24 @@ spec:
       labels:
         app: ghost-en
     spec:
+      # Stage the GitOps-managed redirects file onto the writable content PVC.
+      # A ConfigMap volume is always read-only at the FS level, so the Ghost
+      # entrypoint's `chown -R` on content/ fails ("Read-only file system").
+      # Copying via an initContainer leaves a normal, chownable file on the PVC,
+      # refreshed from the ConfigMap (git source of truth) on every pod start.
+      initContainers:
+        - name: install-redirects
+          image: ghost:5-alpine
+          command:
+            - sh
+            - -c
+            - "mkdir -p /var/lib/ghost/content/data && cp /redirects-src/redirects.yaml /var/lib/ghost/content/data/redirects.yaml"
+          volumeMounts:
+            - name: ghost-en-content
+              mountPath: /var/lib/ghost/content
+            - name: redirects
+              mountPath: /redirects-src
+              readOnly: true
       containers:
         - name: ghost
           image: ghost:5-alpine
@@ -101,12 +119,6 @@ spec:
           volumeMounts:
             - name: ghost-en-content
               mountPath: /var/lib/ghost/content
-            # Custom redirects, GitOps-managed via the ghost-en-redirects ConfigMap.
-            # Nested read-only file mount inside the content PVC's data dir.
-            - name: redirects
-              mountPath: /var/lib/ghost/content/data/redirects.yaml
-              subPath: redirects.yaml
-              readOnly: true
       volumes:
         - name: ghost-en-content
           persistentVolumeClaim: