docs: add tubco setup runbook

DEPLOYMENT.md

@@ -254,6 +254,46 @@ This is destructive. It wipes:
 
 It does not remove the server-local env file. That file must already exist.
 
+## TUBCO customer setup
+For the TUBCO customer line, use the frozen customer branch instead of the normal product branches.
+
+Branch rule:
+- `release/tubco-v1` is the deployment branch
+- do not deploy TUBCO from `develop`
+- do not deploy TUBCO from `main`
+
+Recommended first-time flow:
+1. check out `release/tubco-v1`
+2. create `.env.prod` on the customer server
+3. run a destructive reset/bootstrap from the Mac
+4. import the intended TUBCO config baseline
+5. verify `https://portal.tub.co/healthz/`
+
+Important TUBCO values in `.env.prod`:
+```env
+APP_DOMAIN=portal.tub.co
+APP_BASE_URL=https://portal.tub.co
+DJANGO_DEBUG=0
+DJANGO_SECURE_COOKIES=1
+DJANGO_SECURE_SSL_REDIRECT=1
+```
+
+Customer reset from scratch:
+```bash
+git checkout release/tubco-v1
+RESET_CONFIRM=RESET \
+EXPECTED_BRANCH=release/tubco-v1 \
+DEPLOY_HOST=root@<customer-host> \
+DEPLOY_PATH=/opt/workdock \
+REMOTE_ENV_FILE=.env.prod \
+HEALTH_URL=https://portal.tub.co/healthz/ \
+RUN_DJANGO_CHECK=1 \
+./scripts/reset_stack_from_mac.sh
+```
+
+The full customer runbook lives in:
+- [TUBCO_SETUP.md](/Users/bostame/Documents/workdock-platform/TUBCO_SETUP.md)
+
 ## Manual production deployment
 For production, use a dedicated helper instead of the test script.
 
@@ -366,6 +406,9 @@ ssh -4 root@192.168.2.55 '
   - PDF letterhead
 - use dry-run first. Treat config sync as an explicit operator action, not something hidden inside deploy.
 
+For the customer-specific version of this workflow, including `portal.tub.co` examples, use:
+- [TUBCO_SETUP.md](/Users/bostame/Documents/workdock-platform/TUBCO_SETUP.md)
+
 ## GitHub Actions workflows
 ### Test deployment workflow
 File: