site-deploy: canonical reusable gated+signed deploy workflow

[bdelanghe]

The canonical home for the deploy pipeline (your org-canonical direction): every bounded-systems site derives one source of truth instead of copy-pasting deploy.yml.

What it is

A workflow_call reusable workflow. A caller builds + keyless-signs its site to an OCI artifact, then:

deploy:
  needs: build
  uses: bounded-systems/.github/.github/workflows/site-deploy.yml@main
  with:
    oci: ${{ needs.build.outputs.oci }}
    domain: https://robertdelanghe.dev
    identity_regexp: ^https://github.com/bdelanghe/site/
  secrets:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

What it does

• preview — pull + cosign-verify the artifact → upload an un-served Cloudflare version → cryptographically verify that version's own stable preview URL. This is the deterministic design: <version>-<worker>.workers.dev serves exactly that version, so there's no edge-propagation race — it retires the retry we needed on the per-site pipeline. A failed verify means no promotion.
• promote — gated behind the caller's site-promote Environment (required reviewers). On approval, deploy the same reviewed version to 100% prod, then confirm prod routes to it (manifest equality) + an RFC 9110 probe.

The heavy crypto check happens once, deterministically, pre-promotion; promote only proves prod serves the already-verified bytes.

Validation plan

Reusable workflows are callable from a branch, so bdelanghe/site's caller PR will point at @feat/canonical-site-deploy for a real gated test run before this merges to main. Built from the exact green pipeline (bdelanghe/site #162→#167).

🤖 Generated with Claude Code