fix(portal): prepare approved resource mappings safely

www/integrations/nixos/deploy.md

@@ -61,7 +61,6 @@ npm run deploy:rollback -- FULL_APPROVED_SHA --confirm
 ## Employee resources: separate one-time operation
 
 Approved non-PHI employee files are never part of an ordinary release. After
-the website release that contains `portal-resource-install.sh` is promoted and
 the VPS SOPS-backed Basic Auth material is independently ready:
 
 ```sh
@@ -72,15 +71,21 @@ AIA_DEPLOY_SSH_IDENTITY="$HOME/.ssh/AIAMarketing" \
 npm run deploy:portal-resources -- --confirm
 ```
 
-The installer invokes the promoted root-only `portal-resource-install.sh` through
-NixOS's base `/bin/sh` and coreutils path; it does not depend on a globally
-installed Node.js runtime. It reads only the private collection manifest,
+For the first install, the client extracts `portal-resource-install.sh` from the
+current reviewed Git commit, uploads it into the root-controlled commit staging
+directory, verifies its SHA-256 remotely, and invokes it through NixOS's base
+`/bin/sh` and coreutils path. A prior public site release and a globally installed
+Node.js runtime are not prerequisites. It reads only the private collection manifest,
 accepts approved `STAFF-INTERNAL` and `MANAGEMENT-INTERNAL` mappings to
 `/staff-resources/` and `/management-resources/`, verifies every local hash, rejects links/traversal and
 uploads a root-controlled temporary tree. It never uses `--delete` for resource
 directories and refuses to replace a different existing file. The VPS installs
 regular files as `root:nginx` mode `0640` and reports metadata only.
 
+Local mapping approval authorizes preparation and installation only. After the
+authorized VPS rehearsal, verify installed hashes, ownership/mode, staff versus
+management Basic Auth, and both protected URLs before deploying portal links.
+
 Before public DNS cutover, test the site with approved host-header/SNI methods,
 including the portal’s noindex response, valid ciphertext unlock, both protected
 resource namespaces, denial cases, redirects, Form A, IPv4 and IPv6. Portal