[voltcrash]

Production deployments still used a daily date allocator, skipped unchanged commits, and published GitHub releases without independently verifying CI for the deployment SHA. Repeated production builds also meant validation and upload could use different output.

Replace that pipeline with Oxytype's deployment model across 17 focused commits:

• Trigger after successful main-push CI; validate the latest CI result for that exact SHA before preparing credentials. Check out and label the CI snapshot even when main has advanced.
• Allow manual main retries, unchanged commits, and multiple deployments per day. Remove the date planner, release publisher, version allocator, changelog generator, and their obsolete contracts.
• Build the Worker and client once with an internal SHA/run/attempt ID. Seal file fingerprints outside the public client tree; validate the same artifact before dry-run and upload. Reject mixed build IDs, changed files, private settings, symlinks, and private VERSION overrides.
• Apply D1 migrations followed by PRAGMA optimize. Enable and verify read replication before deployment; keep dry-runs free of remote database mutations.
• Use Contents/Actions read permissions and checkout without persisted credentials. Keep serialized deployments and always-run private-file cleanup.
• Share Node 24.22.1 through .node-version and setup-vp v1.22.0. Update CI to build production explicitly before its artifact dry-run.

At the owner's request, the three existing GitHub releases (v26.10.12, v26.10.13, v26.10.14) and their associated remote tags were deleted separately. The release and tag lists were verified empty. Historical rollout records are marked as historical rather than current deployment instructions.

Validation:

• Frozen-lockfile install, vp check, all 531 unit tests, workspace types, and Worker builds passed.
• All 20 browser tests passed, including public build metadata/cache headers. An earlier navigation-history check failed intermittently, then passed both its focused rerun and the full suite; its test behavior was unchanged.
• Staging and production Wrangler dry-runs passed. Production was checked with both D18 provider-free settings and the exact synthetic AI settings from CI.
• Revalidation after the production dry-run confirmed the same build ID and file fingerprints; checks and dry-run performed no rebuild.
• Workflow execution tests cover CI failures, advanced main, unchanged/same-day retries, ordering, command failures, private-file permissions, and cleanup. Cloudflare replica tests use mocked APIs.

Merging this PR enables automatic deployment after successful main-push CI. Keep VERSION out of PRODUCTION_WORKER_ENV; the build owns it. The Cloudflare token needs D1 edit access for replica activation. Existing runtime reads remain on the primary; session/bookmark routing is outside this deployment change. No hosted Worker or D1 mutation was performed during validation.

Current operator commands are in docs/production-setup.md. docs/production-workflow-comparison.md records remaining differences from Oxytype: Rust/Wasm preparation, public build settings, service-worker/previous-asset handling, runtime replica routing, retired queue cleanup, CI organization, and staging validation.