feat(ghost-en): GitOps-managed redirect for old Pentagon slug

Recover ~454 GSC impressions stranded on a 404. Adds a ghost-en-redirects
ConfigMap (content/data/redirects.yaml) 301-redirecting the old slug
/pentagon-second-uap-declassification-may-2026-apollo-12-sandia/ to the
live /pentagon-uap-second-release-may-2026/. Mounted read-only via subPath
so it survives content PVC recreation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ghost-en/configmap-redirects.yaml

@@ -0,0 +1,14 @@
+---
+# Ghost custom redirects (content/data/redirects.yaml).
+# Managed via GitOps so it survives content PVC recreation.
+# Mounted read-only via subPath into the Ghost container; edits require a
+# `kubectl rollout restart` (subPath mounts do not hot-reload on ConfigMap change).
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ghost-en-redirects
+  namespace: ghost-en
+data:
+  redirects.yaml: |
+    301:
+      ^/pentagon-second-uap-declassification-may-2026-apollo-12-sandia/?$: /pentagon-uap-second-release-may-2026/

ghost-en/deployment.yaml

@@ -101,10 +101,19 @@ spec:
           volumeMounts:
             - name: ghost-en-content
               mountPath: /var/lib/ghost/content
+            # Custom redirects, GitOps-managed via the ghost-en-redirects ConfigMap.
+            # Nested read-only file mount inside the content PVC's data dir.
+            - name: redirects
+              mountPath: /var/lib/ghost/content/data/redirects.yaml
+              subPath: redirects.yaml
+              readOnly: true
       volumes:
         - name: ghost-en-content
           persistentVolumeClaim:
             claimName: ghost-en-content
+        - name: redirects
+          configMap:
+            name: ghost-en-redirects
 
 ---
 apiVersion: v1