Deploy: stage static sync (assets→shell→SW) to avoid deploy-race blank screens

Per Codex. Shared deploy/sync-static.sh used by both publish scripts: sync new
hashed chunks first WITHOUT pruning old ones (grace window so in-flight/old
clients keep chunks they still need), then other assets, then index.html, then
service-worker.js last — so a new shell never appears before its chunks exist.
Old immutable chunks pruned after 14 days to bound disk growth.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/sync-static.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Sync the built static site to the live root in an order that avoids deploy-race
+# blank screens. rsync isn't atomic, so a naïve `rsync --delete` can briefly serve
+# a NEW index.html that points at chunks not synced yet (→ failed load), or delete
+# old chunks an in-flight client still needs. Instead:
+#   1. new hashed chunks first, and DON'T prune old ones (grace window)
+#   2. other static assets (version.json, env.js, icons…), pruning removed files
+#   3. the shell HTML — only once its chunks already exist
+#   4. the service worker last — a returning client adopts it only after the rest
+# Old immutable chunks are pruned after a grace window to bound disk growth.
+set -euo pipefail
+src="$1"; site="$2"
+
+rsync -a "$src/_app/immutable/" "$site/_app/immutable/"
+rsync -a --delete \
+  --exclude='_app/immutable/***' --exclude='index.html' --exclude='service-worker.js' \
+  "$src/" "$site/"
+rsync -a "$src/index.html" "$site/index.html"
+rsync -a "$src/service-worker.js" "$site/service-worker.js"
+find "$site/_app/immutable" -type f -mtime +14 -delete 2>/dev/null || true