feat(3d): live models CDN — 10.0.3 publish wiring + wrl→step fallback

- kicad-packages3D is STEP-only from the 10.x tags: ensureModelInMemfs
  falls back from a missing .wrl to the same-stem .step, written and
  answered under the .step path (the returned path's extension picks
  the parsing plugin — no C++ awareness). Verified against the live
  CDN with the gallery demo board (4/4 wrl refs served as step).
- upload-models-r2.sh: rclone/S3 bulk upload of a local publish layout
  (wrangler-per-object can't move ~14k blobs); published 10.0.3 —
  105 libs / 7,238 models, 3.4GB raw → 500MB brotli — to pcbjam-cdn.
- deploy-demo.yml MODELS_TAG=10.0.3 → build-demo --models-tag →
  VITE_MODELS_MANIFEST_URL (matches LIB_TAG: model refs come from the
  footprints at that release).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014AT7gVHRktDYoQ68S4x6A4

.github/workflows/deploy-demo.yml

@@ -28,6 +28,10 @@ env:
   # KiCad library snapshot the demo points at (published once by publish-libs.yml
   # to libs/kicad/<LIB_TAG>/). Bump when moving to a newer KiCad library release.
   LIB_TAG: "10.0.3"
+  # kicad-packages3D snapshot the demo's lazy 3D models point at (published once
+  # to libs/kicad-models/<MODELS_TAG>/ — see scripts/deploy/publish-models.ts +
+  # upload-models-r2.sh; docs/features/3d-models). Empty ⇒ 3D models off.
+  MODELS_TAG: "10.0.3"
   PAGES_PROJECT: pcbjam-demo
   # MUST be the Pages project's PRODUCTION branch — any other value makes
   # `wrangler pages deploy` a PREVIEW deploy and demo.pcbjam.com won't update.
@@ -94,6 +98,7 @@ jobs:
         run: >
           node scripts/deploy/build-demo.mjs --tag "${{ steps.tag.outputs.tag }}"
           --cdn "$CDN" --lib-tag "$LIB_TAG"
+          ${MODELS_TAG:+--models-tag "$MODELS_TAG"}
           --plausible "${{ vars.PLAUSIBLE_DOMAIN }}"
 
       # 4) Ensure the Pages project exists (first deploy creates it; no-op after).