feat(demo): demo.pcbjam.com deploy — versioned WASM CDN + static gallery + tag CI

Cross-origin WASM CDN (cdn.pcbjam.com, R2): per-tool content-addressed,
immutable folders + a per-release runtime manifest (snapshot from registry).
boot.ts loads pthread workers cross-origin via a same-origin blob shim.
Static no-backend project source (demo gallery; Save downloads to local),
api.uploadFileBytes kept and config-gated. demo.pcbjam.com on Cloudflare Pages.
deploy-demo.yml (tag v*) snapshots WASM + content + builds + deploys;
publish-wasm.yml builds on Ubicloud. Design/spec docs live in pcbjam-private.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/deploy-demo.yml

@@ -0,0 +1,88 @@
+name: deploy-demo
+
+# Tag a release (vX.Y.Z) → reuse the already-published WASM (snapshot it into a
+# per-release manifest), publish the example gallery, build the standalone pinned
+# to the CDN, and deploy it to demo.pcbjam.com (Cloudflare Pages).
+#
+# The heavy WASM build+upload is DECOUPLED (workflow: publish-wasm.yml / a local
+# seed) because the WASM changes rarely; this pipeline never rebuilds it. See
+# docs/features/demo-deploy/.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to deploy, e.g. v1.2.3"
+        required: true
+
+# Serialize demo deploys so two tags don't race the live site (don't cancel a
+# half-finished deploy — let it complete).
+concurrency:
+  group: deploy-demo
+  cancel-in-progress: false
+
+env:
+  CDN: https://cdn.pcbjam.com
+  BUCKET: pcbjam-cdn
+  PAGES_PROJECT: pcbjam-demo
+  # MUST be the Pages project's PRODUCTION branch — any other value makes
+  # `wrangler pages deploy` a PREVIEW deploy and demo.pcbjam.com won't update.
+  # Direct-Upload projects default to "production".
+  PAGES_PROD_BRANCH: production
+  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+  CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+  # The publish scripts shell wrangler; no repo dep — fetch it on demand.
+  WRANGLER_CMD: npx --yes wrangler@4
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      # The standalone needs the MIT pcbjam-shared submodule, but NOT the huge
+      # kicad/wxwidgets ones (WASM is prebuilt on the CDN, not built here).
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+      - name: Init pcbjam-shared submodule
+        run: git submodule update --init --depth 1 web/pcbjam-shared
+
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install standalone workspace
+        run: pnpm --dir web install --frozen-lockfile
+
+      - name: Resolve tag
+        id: tag
+        run: echo "tag=${GITHUB_REF_NAME:-${{ github.event.inputs.tag }}}" >> "$GITHUB_OUTPUT"
+
+      # 1) Reuse prebuilt WASM: snapshot the current registry into manifest-<tag>
+      #    (no build, no upload). Fails if the WASM was never published — run
+      #    publish-wasm.yml (or a local seed) first.
+      - name: Snapshot WASM manifest
+        run: >
+          node scripts/deploy/publish-wasm.mjs --tag "${{ steps.tag.outputs.tag }}"
+          --driver r2 --bucket "$BUCKET" --remote --from-registry
+
+      # 2) Publish the read-only example gallery (tiny; content/<tag>/).
+      - name: Publish content gallery
+        run: >
+          node scripts/deploy/publish-content.mjs --tag "${{ steps.tag.outputs.tag }}"
+          --gallery deploy/demo/gallery.json --driver r2 --bucket "$BUCKET" --remote
+
+      # 3) Build the standalone pinned to the CDN + this tag's manifests.
+      - name: Build demo
+        run: node scripts/deploy/build-demo.mjs --tag "${{ steps.tag.outputs.tag }}" --cdn "$CDN"
+
+      # 4) Deploy to Cloudflare Pages (demo.pcbjam.com is the project's custom domain).
+      - name: Deploy to Cloudflare Pages
+        run: >
+          npx --yes wrangler@4 pages deploy web/standalone/dist
+          --project-name "$PAGES_PROJECT"
+          --branch "$PAGES_PROD_BRANCH"
+          --commit-dirty=true