fix(build): the sahajatlas Worker is gone, so no PR gets a preview #356

Summary

No pull request in this repo can pass CI: the Smoke job's publish step answers "You cannot
upload a new version of a Worker that does not yet exist. Please run the deploy command
first." The sahajatlas Worker — the app's deploy target in docs/rules/deployment.md — does
not answer at its own workers.dev host, nor at any earlier preview alias. sahajatlas.com
still serves correctly, so this is not a visitor-facing outage today, but the deploy target the
repo is configured against is in an unknown state.

Approach

The cause is outside this repository, and no commit here fixes it. wrangler.jsonc,
.github/workflows/ci.yml and the publish step are unchanged since the last green run. Two
candidate causes, and the dashboard decides which:

1. The Worker was deleted. wrangler.jsonc:18 warns twice that sahajatlas was also the
   retiring Pages project's name. chore(build): cut sahajatlas.com over to Workers and delete Pages #283's last phase deletes that Pages project; deleting the
   Worker of the same name instead fits every measurement below.
2. The CI credential moved. CLOUDFLARE_API_TOKEN or CLOUDFLARE_ACCOUNT_ID now reads an
   account that holds no sahajatlas Worker. Workers Builds: sahajatlas-design still passes,
   but that uses Cloudflare's own git integration, not these two secrets, so it does not
   discriminate.

⚠ The repo-side "fix" is wrong. Changing versions upload to deploy in ci.yml:220
would make every pull request deploy to production. ci.yml:194 and docs/testing.md state why
the command is versions upload: it uploads a version and deploys nothing, so production traffic
never moves.

Whichever cause holds, docs/rules/deployment.md is then wrong about what serves
sahajatlas.com, because it was written on the assumption that the Worker is what does.

Acceptance criteria

• CI's Smoke job on an open pull request publishes a preview and runs its 18 specs, instead
  of reporting "NO smoke specs ran".
• https://sahajatlas.contact-c66.workers.dev/ serves the app, or
  docs/rules/deployment.md says that host is deliberately off and what serves the domain
  instead — verified, not assumed.
• A deploy of main lands on the Worker wrangler.jsonc names.
• docs/rules/deployment.md records what this incident found, so the next reader is not
  re-deriving it.

Verification checklist

• curl -sS -o /dev/null -w '%{http_code}\n' https://sahajatlas.contact-c66.workers.dev/ —
  not 404 with Cloudflare error code: 1042
• Re-run CI on any open pull request: the Smoke check is green, and its step summary
  reports specs run rather than the publish warning
• curl -sSI https://sahajatlas.com/embed.js still carries
  cache-control: public, max-age=0, must-revalidate and access-control-allow-origin: *
• curl -sS https://sahajatlas.com/robots.txt | head -1 is still our own file

Notes

Measured 2026-11-01, 20:21–20:40 UTC, from the fix-ci run on #355:

The window: CI run 551 was green at 19:10 UTC; run 552 (#353,
claude/feat-17-brand-map-markers) failed at this same publish step at 20:05 UTC, and run 553
(#355) at 20:21 UTC. The two branches share nothing, so the failure is
repo-wide, not a branch's.

Priority is High, not Critical: every pull request is blocked, but no visitor-facing outage
was observed. Raise it if sahajatlas.com starts failing.

Related, not a parent: #266 is the Pages-to-Workers goal, and
#283 is the cutover whose last phase deletes the same-named Pages project.