ci: one build before the deploys, artifacts reused (DEV-2203)

[danielzytohoc]

Follow-up to #189 per Dan's review: both deploy jobs each ran pnpm install + pnpm build, duplicating the workspace build whenever a push touched shared paths.

New shape

changes ─► build ─┬─► deploy-authoring ─┐
                  └─► deploy-api ───────┴─► smoke

• build (gated on either deploy firing): one install, one pnpm build, uploads runtime-dist; builds + uploads the authoring app too (with the SENTRY env), skipped when only the api deploys.
• deploy-authoring: checkout + download authoring-dist + pinned-npx wrangler deploy + the bundle-hash smoke — no pnpm install at all (wrangler ships ./dist as Workers Assets; checkout supplies wrangler.jsonc).
• deploy-api: keeps install (its pnpm run deploy runs the workspace wrangler and bundles the worker) but resolves @handsontable/demo-runtime from the downloaded artifact instead of rebuilding it; D1 migrations + health smoke unchanged.

A broken build still can't reach wrangler — it just fails once, earlier, in the shared job.

Note on merge

This PR touches master.yml, which is in both deploys' path sets — merging it will fire both deploys + the post-deploy smoke, i.e. the first full end-to-end run of the new pipeline. Worth watching that run.

---

Note

Medium Risk
Changes production deploy orchestration on master; a misconfigured artifact path or job needs/if could block or ship stale builds, though build still gates wrangler the same way as before.

Overview
Master deploy pipeline is reshaped so workspace and authoring builds happen once, then deploy jobs reuse artifacts (follow-up to #189).

A new build job runs when either path-gated deploy would fire: one pnpm install, one pnpm build, upload of runtime-dist, and (when authoring deploys) authoring build with Sentry env plus authoring-dist. deploy-authoring now only checks out, downloads authoring-dist, and runs pinned wrangler deploy—no pnpm install. deploy-api still installs (worker pnpm run deploy bundles via workspace wrangler) but downloads runtime-dist instead of rebuilding @handsontable/demo-runtime. Post-deploy smoke and D1/health checks are unchanged.

runner/AGENTS.md documents the new changes → build → deploy-* → smoke flow.

^{Reviewed by Cursor Bugbot for commit 02b55da. Bugbot is set up for automated code reviews on this repo. Configure here.}