H3.2 — Add Cloudflare Pages migration bridge

[maruson08]

Summary

• add a main-only Cloudflare Pages Direct Upload workflow for secure-tools-web-bridge
• preserve the existing repository-root GitHub Pages deployment and CNAME
• copy application files into a temporary bridge artifact and inject bridge-only X-Robots-Tag: noindex, nofollow
• authenticate and validate the expected Pages project, main production branch, zero custom domains, Direct Upload mode, and disabled Web Analytics before deployment
• validate all 19 H3.1 routes, representative assets, and the deployed noindex header after upload
• document provenance, least-privilege credentials, validation, and removal

Validation

• both required repository secret names are configured; no values were read
• secure-tools-web-bridge.pages.dev resolves and the provisioned project targets main with no custom domains
• node tests/run-all.mjs passes
• bridge workflow contract test passes
• temporary artifact preparation succeeds with 19 route entry points
• temporary artifact excludes CNAME, _redirects, _worker.js, and functions
• git diff --check passes
• no application, canonical, sitemap, robots, production CNAME, or existing CI workflow file changed

Production safety

The bridge is additive and has no custom domain. securetools.app remains the unchanged GitHub Pages production site. No DNS, Search Console, redirect, canonical, sitemap, analytics, telemetry, Workers, Pages Functions, or application-runtime migration is included.

Closes #67