Split the post-deploy smoke probe by what each half can prove

[stiebitzhofer]

Summary

The post-deploy smoke step from #111 turned every deploy on main red. Fixing my own breakage.

From the runner, the two paths the step exists to guard passed; the two canaries did not:

path	result
/	403 (10 retries, ~100s)
/feed.xml	403 (10 retries, ~100s)
/.well-known/security.txt	200
/.well-known/pgp-security.asc	200

Cause: Cloudflare bot protection blocks the runner's datacenter IP on ordinary paths and exempts /.well-known/ by design, so ACME and security.txt keep working. Exactly the paths we care about got through. Not a site fault — verified simultaneously that the Pages origin serves all four, and that both canary paths return 200 from a residential IP.

Fix

Split the probe by what each half can actually prove:

• Origin, all paths — artifact completeness. No bot protection in front of it, and this is the /.well-known/ 404s in production: upload-pages-artifact strips dot-directories #110 class (a directory silently missing from the artifact) generalized past the two files that happened to expose it.
• Canonical host, /.well-known/ only — the Worker's rewrite. Now asserts content types rather than status: text/plain; charset=utf-8 and application/pgp-keys are the actual requirement from Serve the security contact's PGP key at /.well-known/pgp-security.asc #107/Add /.well-known/security.txt (RFC 9116), with an expiry check so it cannot rot #109, and a 200 with the wrong type is still a regression.

Dropping the canaries is not a weakening. They existed to distinguish "site is down" from "well-known is missing", and a 200 from /.well-known/security.txt on that same host already settles the first. The origin half covers both paths for completeness.

Rejected: a Cloudflare WAF skip rule for GitHub's IP ranges. A manual console change (Manual-Setup-Checklist.md territory) that widens the site's exposure to make a test convenient, covering ground the origin probe already covers.

Closes #112

Test plan

• deploy.yml parses; both steps present in order
• Origin loop run locally against the live origin — all four 200, fail=0
• Content-type function run locally under bash -e (the shell Actions uses) against the live site — both types match, and a deliberately missing path correctly yields fail=1 rather than passing silently or aborting the step
• After merge: the deploy run must go green — that is the actual verification