infra: automate isolated Cloudflare PR previews

[phibkro]

Design spec

design-specs/0020-pr-preview-delivery.md

Journey

This PR defines and will implement the trusted delivery system that builds an exact PR head without credentials, promotes digest-bound artifacts through base-owned tooling, provisions isolated vektor-p<PR> Cloudflare resources, deploys the homepage/dashboard/Symfony surfaces, loads a deterministic production-shaped synthetic MariaDB seed, and runs remote route/component smoke checks.

The first required proof is PR #20 at https://p20.vektor.phibkro.org. Migration production is https://vektor.phibkro.org. Actual production vektorprogrammet.no is forbidden.

Current state

This first commit is the independently reviewed, frozen contract and bootstrap boundary. Credentialed preview deployment cannot run until the base-owned bootstrap workflow lands on main; pre-bootstrap checks remain credential-free and plan-only. Implementation follows on this PR after that trust edge exists.

Architecture decision

• GitHub Actions owns PR events and full Bun/PHP CI; Cloudflare Builds/Workflows cannot replace the required runner and close/reconcile lifecycle.
• Alchemy v2 owns stage-scoped Cloudflare resources and teardown.
• A Worker routes to a container-backed Durable Object and Cloudflare Container running Symfony plus container-local MariaDB.
• The Durable Object owns routing/lifecycle only, never relational data.
• The seed is fully synthetic and deterministic: exact schema and production-like volume/distributions, with no production rows, topology, PII, credentials, tokens, messages, or uploaded files.

Evidence

• Semantic design review: PASS at b3eb1ac, with final bootstrap/ledger evidence bindings added at 701867e.
• Security/feasibility review: PASS at b3eb1ac.
• Spec-only branch; implementation and provider mutation have not started.

What is real

The architecture and executable acceptance contract are reviewed. No Cloudflare resource, DNS record, preview database, deployment, repository secret, or migration-production resource has been created by this PR yet. No action touches vektorprogrammet.no.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 701867e8a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Permit synchronization from in-flight states

When another commit is pushed before the previous revision reaches Live—for example while it is Validating, Applying, Seeding, or recovering from cancellation—this mandatory sequence has no legal starting transition. Although some states individually allow Retiring, the synchronize contract and corresponding falsifier require Live → Retiring, so an ordinary rapid update can strand the preview or force the stale revision to finish deployment first. Allow synchronize to retire and clean up every non-absent active state before requesting the new SHA.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Define request routing to the frontend Workers

For the single canonical p20 hostname, the accepted graph sends the public Worker only to the Durable Object/container path, while the homepage and dashboard Workers are merely provisioned and have no incoming request path. Because those applications perform their own Worker/SSR route handling (apps/homepage/workers/app.ts and the dashboard React Router app), the required homepage/dashboard browser journey cannot reach them through this graph. Freeze a path split, service bindings, or another explicit dispatch topology before treating the resource graph as executable.

Useful? React with 👍 / 👎.