ci(web): codify the Vercel deployment

[SarthakWade]

Summary

• add a root vercel.json for the pnpm monorepo install, Next.js build, development command, and output directory
• document the production, preview, domain, security-header, verification, and rollback contracts
• lint deployment config, canonical URL, and security-header ownership to prevent dashboard/repository drift
• retain headless-web-pi.vercel.app as canonical until LockInTime publishes a verifiably controlled custom domain

Validation

• Vercel config fields checked against https://openapi.vercel.sh/vercel.json
• pnpm dlx prettier --check ...
• pnpm --filter @headless/web lint
• pnpm --filter @headless/web build
• pnpm test
• pnpm test:runtime
• pnpm build
• pnpm test:e2e:linux

Deployment verification

The public deployment is stale and GitHub records no Vercel deployment after August 4, 2026. No Vercel credentials or authenticated dashboard session are available in this environment. A Vercel project maintainer must reconnect the GitHub integration and verify this PR receives a preview URL before this PR is ready to merge and #47 can close.

Refs #47

[yashranaway]

Review found and fixed two deployment issues: the custom pnpm install override could select Vercel’s oldest pnpm runtime even though this repo requires pnpm 9+, and the development command did not pass Vercel’s required $PORT. The branch now relies on lockfile-based pnpm detection, validates that contract, passes $PORT, combines both web policy validators from main, and passes web lint/build locally. The remaining blocker is account-level: this head SHA still needs a Vercel preview deployment before the draft is ready to merge.