A theme becomes trustworthy when updating it is boring. The package should be named, checked, hashed, and reversible. The site’s content should be outside the ZIP. The active version should be known before a new one is uploaded.
For Docspress, that means local checks first, then a disposable or isolated WordPress acceptance pass, then the `wordpress.im/docspress/` site. GitHub publication is a later decision, not a prerequisite for making the site useful now.
The maintenance page is part of the demo because the product is not only a visual surface. It is also a small, understandable operation that a future editor can safely continue.