ci: induce the standalone Next output so the tested bundle can be packaged

`opennextjs-cloudflare build --skipNextBuild` reads
`.next/standalone/apps/docs/.next/server/pages-manifest.json`, and a plain
`next build` writes no `.next/standalone/` at all — so the packaging step
added in the previous commit failed with ENOENT on that path. Measured, not
guessed: CI run 33879772449 on this branch.

The reason is that `output: 'standalone'` is not in `next.config.mjs`;
`@opennextjs/aws` sets `NEXT_PRIVATE_STANDALONE=true` before it runs the Next
build itself, with the comment "Equivalent to setting `output: \"standalone\"`
in next.config.js". Skipping its build skipped that too.

So the env var is set on the `build` job instead of editing
`apps/docs/next.config.mjs`, which is outside this card's file surface and
would change how the app builds for every consumer rather than only in CI.

It must also be declared in `turbo.json`: turbo 2 runs tasks in strict env
mode, so an undeclared variable never reaches `next build` — and declaring it
is what puts it in the cache key, so a `.next` cached from before this change
cannot be replayed without the standalone tree the packaging step needs.

Also adds a TEMPORARY `verify-plumbing` job, removed before merge, that runs
the rollback job's own `gh workflow run` command with the same GITHUB_TOKEN
and `actions: write` and confirms from the API that a run was really created.
That path only ever executes during an outage, and if GITHUB_TOKEN cannot
dispatch a workflow here the automatic rollback would silently never fire.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GkauAsZBEemRbco2rEX9Lx

Author: claude

.github/workflows/ci.yml

@@ -45,6 +45,26 @@ jobs:
 
   build:
     runs-on: ubuntu-latest
+    # `NEXT_PRIVATE_STANDALONE` is what `@opennextjs/aws` sets before it runs
+    # `next build` — its own comment reads "Equivalent to setting `output:
+    # "standalone"` in next.config.js". Without it a plain `next build`
+    # produces no `.next/standalone/`, and the packaging step below fails on a
+    # missing `pages-manifest.json` three directories inside it. Measured on
+    # this branch before it was set: `ENOENT ... .next/standalone/apps/docs/
+    # .next/server/pages-manifest.json`.
+    #
+    # Set for the whole job rather than for the deploy path only, so that what
+    # a pull request builds is the same shape as what gets published. A build
+    # that differs from the deploy build is a small instance of the defect this
+    # card is about.
+    #
+    # It has to be declared in `turbo.json` as well: turbo 2 runs tasks in
+    # strict env mode, so an undeclared variable never reaches `next build` —
+    # and declaring it is also what puts it in the cache key, so a `.next`
+    # cached from before this line cannot be replayed without the standalone
+    # tree the packaging step needs.
+    env:
+      NEXT_PRIVATE_STANDALONE: 'true'
     steps:
       - uses: actions/checkout@v7
       - uses: pnpm/action-setup@v6

.github/workflows/deploy-docs.yml

@@ -81,6 +81,11 @@ on:
         required: false
         type: boolean
         default: false
+      verify_plumbing:
+        description: 'TEMPORARY (removed before merge). Prove GITHUB_TOKEN can dispatch rollback-docs.yml at all.'
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   deploy:
@@ -331,3 +336,54 @@ jobs:
             URL="$(gh issue create --title "$TITLE" --label "$LABEL" --body "$BODY")"
             echo "::notice::filed $URL"
           fi
+
+  # TEMPORARY — removed before this PR merges.
+  #
+  # The `rollback` job above is the one part of this pipeline that only ever
+  # runs during an outage, and it depends on something not obvious: whether
+  # GITHUB_TOKEN is allowed to dispatch a workflow at all. GitHub suppresses
+  # workflow triggering from token-driven events in several cases; if that
+  # applied here the automatic rollback would silently never happen, which is
+  # the exact failure class this card exists to eliminate.
+  #
+  # So: run the same command, with the same token and the same permission, and
+  # confirm from the API that a run was really created. `rollback-docs.yml`
+  # with a blank `version_id` lists versions and changes nothing, so this is
+  # safe to fire against production.
+  verify-plumbing:
+    name: TEMPORARY - prove the rollback dispatch fires
+    if: inputs.verify_plumbing
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - uses: actions/checkout@v7
+      - name: Dispatch rollback-docs.yml with a blank version_id
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          LATEST='repos/'"$GH_REPO"'/actions/workflows/rollback-docs.yml/runs?per_page=1'
+          BEFORE="$(gh api "$LATEST" --jq '.workflow_runs[0].id // 0')"
+          echo "latest rollback run before: $BEFORE"
+
+          gh workflow run rollback-docs.yml --ref "$DEFAULT_BRANCH" \
+            -f version_id= \
+            -f reason="plumbing check from the #269 branch: lists versions, changes nothing"
+
+          AFTER="$BEFORE"
+          for _ in $(seq 1 24); do
+            sleep 5
+            AFTER="$(gh api "$LATEST" --jq '.workflow_runs[0].id // 0')"
+            [ "$AFTER" != "$BEFORE" ] && break
+          done
+
+          if [ "$AFTER" = "$BEFORE" ]; then
+            echo "::error::GITHUB_TOKEN did NOT create a rollback-docs run — the automatic rollback would silently never fire"
+            exit 1
+          fi
+          echo "::notice::rollback-docs.yml run $AFTER was created by GITHUB_TOKEN"

turbo.json

@@ -4,6 +4,7 @@
   "tasks": {
     "build": {
       "dependsOn": ["^build"],
+      "env": ["NEXT_PRIVATE_STANDALONE"],
       "inputs": ["$TURBO_DEFAULT$", "$TURBO_ROOT$/content/docs/**"],
       "outputs": ["dist/**", ".next/**", "!.next/cache/**"]
     },