Document skopeo --insecure-policy for the Fly push on NixOS

NixOS ships no default containers policy.json, so skopeo copy aborts with a
trust-policy error. Add --insecure-policy to the documented push command and
gitignore the result-fly build symlink.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitignore

@@ -1,6 +1,7 @@
 /target
 /backend/target
 /result
+/result-fly
 oott.db
 oott.db-wal
 oott.db-shm

deploy/fly/README.md

@@ -44,7 +44,10 @@ nix build .#flyImage -o result-fly
 
 # Push the image straight from the Nix store archive to Fly's registry.
 # No Docker daemon involved; skopeo authenticates with a short-lived Fly token.
-skopeo copy --dest-creds "x:$(fly auth token)" \
+# --insecure-policy skips skopeo's trust-policy check: on NixOS there is no
+# default /etc/containers/policy.json, and we are pushing our own freshly built
+# image, so there is nothing to verify.
+skopeo copy --insecure-policy --dest-creds "x:$(fly auth token)" \
   docker-archive:result-fly \
   docker://registry.fly.io/oott-test:latest
 ```

deploy/fly/fly.toml

@@ -8,7 +8,7 @@
 # See deploy/fly/README.md for the full deploy procedure.
 
 app = "oott-test"      # change to your chosen Fly app name
-primary_region = "yyz" # change to a region near you / the reviewers
+primary_region = "yyz" # change to a region near you / the reviewersu
 
 # The image is built with Nix and pushed to the Fly registry (see README),
 # so there is no [build] section: deploy with `fly deploy --image ...`.