perf(cdn): publish demo WASM as brotli-q11 + no-transform

release.yml's publish-wasm job now uploads .wasm/.js with
`--compress br --quality 11` instead of gzip-6, and IMMUTABLE
content-addressed blobs carry `no-transform` so Cloudflare's edge
can't decompress + re-serve them at its on-the-fly br-4 (and the
original Content-Length passes through).

~15-20% smaller wasm on cdn.pcbjam.com. Forward-only: tool folders
already published stay gzip until their source changes (identity is
hashed over uncompressed bytes, so the compressor switch never
re-versions or re-uploads existing folders).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/release.yml

@@ -82,7 +82,7 @@ jobs:
       - name: Publish WASM to CDN
         run: >
           node scripts/deploy/publish-wasm.mjs --tag "${{ needs.meta.outputs.tag }}"
-          --src output --driver r2 --bucket "$BUCKET" --remote --compress gzip
+          --src output --driver r2 --bucket "$BUCKET" --remote --compress br --quality 11
 
   # 3) Build the standalone pinned to this tag's manifest + libs, deploy to Pages.
   deploy-demo:

scripts/deploy/lib/cdn-store.mjs

@@ -17,7 +17,10 @@ import { gzipSync, brotliCompressSync, constants as zc } from "node:zlib";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
 
-export const IMMUTABLE = "public, max-age=31536000, immutable";
+// `no-transform` keeps Cloudflare's edge from decompressing our pre-compressed
+// (brotli-q11) blobs and re-serving them at its own on-the-fly quality (br-4);
+// also preserves the original Content-Length. Immutable content-addressed blobs.
+export const IMMUTABLE = "public, max-age=31536000, immutable, no-transform";
 export const NO_STORE = "no-store";
 
 export const sha256hex = (buf) => createHash("sha256").update(buf).digest("hex");