After approving: in the private repo, python3 scripts/apply-portal-changes.py --fetch, then --apply --dry-run, read the diff, --apply, then --ack. Sync, build, deploy. An approved photo comes down the same way, into pictures/<slug>/, with a MEMBER_PHOTOS_LOCAL block to paste; the alt text is yours to write.