ci: adopt shared Cloudflare Pages delivery

[hseshadr]

Summary

• bind the exact protected green-main Dagger attempt through the shared Foundation before product work
• deliver one closed static + Pages Functions envelope through the central Cloudflare Pages Lego
• materialize provider evidence once, then verify live static, signed bundle, feedback, and nonfatal IndexNow behavior

Verification

• 74 deployment/Foundation/workflow contracts (194 assertions)
• Dagger backend, frontend, browser, PDF, privacy, and final closed Functions contract gates
• actionlint; targeted/full zizmor; Bun and Python dependency audits
• independent review: Ready Yes, no findings

No provider, production environment, or secret mutation was performed.