Separate Unity build, DoIT deploy and Vault staging CDN preview

[mrdavidgagnon]

What

One Unity build, deployed independently to two places:

build   (fielddaylab/vault-publisher unity-build.yml@v1: Unity only, uploads an artifact)
  ├─► doit     legacy VPN + rsync → https://fielddaylab.wisc.edu/play/spacefab/ci/<branch>/
  └─► preview  Vault staging CDN  → https://cdn.vaultlearninggames-staging.org/fielddaylab/spacefab/<branch>/
remove-preview (on branch delete)

• The two deploys don't depend on each other: a DoIT/VPN failure no longer affects the preview, and vice versa.
• The VPN now connects right before the rsync (and waits for the tunnel), instead of before the 45-minute build.
• Retiring DoIT later = deleting the doit job.
• The build step now comes from the shared unity-build.yml@v1 (checkout with LFS + submodules, Library cache, runner disk cleanup, game-ci), so fixes to it reach every game.
• The preview URL shows at the top of each run, in the job summary, and as View deployment on PRs.
• No new secrets: the CDN uses GitHub OIDC; doit uses the existing VPN/DoIT secrets.

Replaces #1 (closed when its branch was renamed: vault-staging-preview matched the Field Day framework's *preview* build config, which currently doesn't compile; dev-vault-staging uses the same DEVELOPMENT config as develop).

Testing

This branch's own push runs all jobs; the preview should appear at …/spacefab/dev-vault-staging/. Deleting the branch after merge should remove it.

🤖 Generated with Claude Code