feat: improve deployment workflows

README.md

@@ -45,6 +45,13 @@ During development:
 bun run index.ts up
 ```
 
+Run the dedicated unit suite and type checks:
+
+```bash
+bun run test
+bun run typecheck
+```
+
 Other useful commands:
 
 ```bash
@@ -58,9 +65,20 @@ bun run index.ts restart
 bun run index.ts db ls
 ```
 
+### Shell Completion
+
+Generate and load completions for your shell:
+
+```bash
+source <(kuber complete zsh)
+source <(kuber complete bash)
+```
+
+For a permanent setup, write the generated script to a file and source it from your shell configuration. Fish and PowerShell are also supported through `kuber complete fish` and `kuber complete powershell`.
+
 ## Commands
 
-- `up`: build images if needed, render manifests, apply them, restart deployments, and wait for rollout
+- `up`: build images if needed, render manifests, apply them, restart deployments whose image content changed, and wait for rollout
 - `start`: same as `up` but skips image builds
 - `stop`: scale managed deployments to zero
 - `restart`: roll out a restart across managed deployments
@@ -92,6 +110,16 @@ services:
 
 That produces a Kubernetes `Ingress` rule for `somedomain.astrxl.dev` pointing at the service port for container port `3000`.
 
+Single-level wildcard subdomains are supported. Quote wildcard entries so YAML does not treat the leading `*` as an alias:
+
+```yml
+services:
+  app:
+    ports:
+      - "*.astrxl.dev:3000"
+      - "*.secure.astrxl.dev:3001:protected"
+```
+
 Protected routes use the kuber dialect and render Traefik `IngressRoute` resources instead of plain Kubernetes `Ingress`:
 
 ```yml
@@ -250,6 +278,8 @@ Precedence:
 
 ## Building
 
+Image builds and image-digest checks run through the selected SSH builder. If a pushed image has the same content fingerprint as the existing registry image, `up` does not restart that deployment.
+
 To build distributable binaries:
 
 ```bash