docs(theseus): add-on update channel lives on Sia, not the VPS — publish with sia-upload

The publishing steps pointed at scp to /opt/silent-mode/site/addons/, which
never existed; the screenshot channel (and now aegis) is served from
s3://bns/theseus/extensions/<id>/ through navigate.st/bns/theseus.x/….
Also: sign from a git-archive copy so uncommitted edits don't ship.

docs/ADDON-UPDATES.md

@@ -37,27 +37,34 @@ no outbound requests.
 
 ### Every update
 
+Sign from a clean copy of the committed add-on (`git archive HEAD …`), not
+the working tree, so another session's uncommitted edits don't ship:
+
 ```
 node scripts/sign-addon-update.mjs \
-    bundled-addons/screenshot \
-    https://addons.silentmode.st/screenshot \
-    "$USERPROFILE/.silentmode/ops/addon-update-key.pem"
+    <clean-copy>/bundled-addons/screenshot \
+    https://navigate.st/bns/theseus.x/extensions/screenshot \
+    "$USERPROFILE/.silentmode/ops/addon-update-key.pem" --out out/
 ```
 
 Produces:
 - `out/screenshot-<version>.tar.gz` — upload to `<base-url>/<id>-<version>.tar.gz`
 - `out/screenshot-<version>.entry.json` — prepend to your live `updates.json`
 
-Then:
+The channel files live on Sia, under `s3://bns/theseus/extensions/<id>/`,
+and are served through the public gateway as
+`https://navigate.st/bns/theseus.x/extensions/<id>/…` — that is what every
+bundled add-on's `updateURL` points at. Nothing is on the VPS filesystem.
+Upload with the Sia uploader (single file → directory prefix, not a full
+target path):
 
 ```
-scp out/screenshot-*.tar.gz silentmode:/opt/silent-mode/site/addons/screenshot/
-scp updates.json           silentmode:/opt/silent-mode/site/addons/screenshot/
+node ../Argus/src/lib/sia-upload.js out/screenshot-<version>.tar.gz bns/theseus/extensions/screenshot
+node ../Argus/src/lib/sia-upload.js updates.json                     bns/theseus/extensions/screenshot
 ```
 
-The Sia autosync timer picks up `/opt/silent-mode/site/` on its usual
-5-minute cadence, so both mirrors update together (see
-`shipping-mirrors` for background).
+Then confirm both URLs answer 200 through the gateway before relying on
+the entry. Live channels: `screenshot` and `aegis`.
 
 ## `updates.json` schema