docs(hermetic-build): Document process for updating golden files

hermetic_build/DEVELOPMENT.md

@@ -34,6 +34,34 @@ because the workflow doesn't have permission to pull images from Airlock.
 
 The Cloud Build job is defined in `.cloudbuild/library_generation/cloudbuild-library-generation-integration-test.yaml` and runs in every pull request.
 
+## Updating the golden files
+
+Instead of holding an entire library as golden files in this repo, we use the
+[`chore/test-hermetic-build`](https://github.com/googleapis/google-cloud-java/tree/chore/test-hermetic-build) branch in
+google-cloud-java for testing.
+
+In order to update:
+
+1. Clone googleapis with `git clone https://github.com/googleapis/googleapis`.
+2. `cd` into googleapis and
+   checkout [the commit declared in the IT file](https://github.com/googleapis/sdk-platform-java/blob/aa4a7f76f5260326583075496444c9434054dc90/.cloudbuild/library_generation/cloudbuild-library-generation-integration-test.yaml#L40C18-L40C58).
+   . 
+3. Clone or `cd` into google-cloud-java and checkout the `chore/test-hermetic-build` branch.
+4. Build the Docker image locally or use a published one:
+5. Generate the libraries
+
+```bash
+docker run \
+  --rm -u "$(id -u):$(id -g)" \
+  -v "$(pwd)/../google-cloud-java:/workspace" \
+  -v "$(pwd)/googleapis:/googleapis" \
+  "your_image_tag"   \
+  --generation-config-path="/workspace/generation_config.yaml" \
+  --api-definitions-path="/googleapis" &> out
+```
+
+6. `cd` into google-cloud-java and push the expected changes.
+
 # Run the unit tests
 
 There is one unit test file per component.