fix(ci): stop profile deploys from overwriting the wiki

[ss-o]

Incident

A push to z-shell/.github triggered .github/workflows/pages-deployment.yml and deployed the repository's Markdown-only profile/ directory to Cloudflare Pages project zsh. That project is the production target for z-shell/wiki, so the profile deployment replaced the wiki production deployment and caused HTTP 404 responses on both zsh.pages.dev and wiki.zshell.dev.

Evidence: https://github.com/z-shell/.github/actions/runs/30406990541
Related control work: #459

Fix

• Remove the obsolete .github profile-to-Cloudflare deployment workflow.
• Keep z-shell/wiki as the sole repository deployment owner for Cloudflare Pages project zsh.
• Verify repository workflow checks.
• After publication, redeploy z-shell/wiki from main and verify both production hostnames return HTTP 200.

Done when

• A push to z-shell/.github cannot deploy to Cloudflare Pages project zsh.
• The wiki deployment workflow remains configured for project zsh.
• The live wiki production aliases serve the wiki again.

[ss-o]

Agent handoff

Status: In progress
Repository: z-shell/.github
Branch/PR: local branch codex/fix-cloudflare-project-collision, commit fcfe01b; no remote PR
Tracker/Issue: #490

Current state

• Git history confirms z-shell/wiki targeted Cloudflare Pages project zsh first, on 2022-12-17.
• The z-shell/.github workflow was created later, on 2023-03-12, already targeting zsh. No previous or renamed project was found.
• Retained Actions history shows .github deployments failed before reaching Cloudflare until PR fix(ci): remove redundant build/ artifacts and publish profile/ directly #443 removed the failing pnpm build path. Run 27410691451 on 2026-06-12 was the first retained success and uploaded 20 profile files to zsh.
• Local commit fcfe01b deletes .github/workflows/pages-deployment.yml, leaving wiki as the sole configured owner of zsh.
• Wiki workflow-dispatch run 30424725252 restored production on 2026-07-29. Both https://wiki.zshell.dev and https://zsh.pages.dev currently return HTTP 200.

Verification

• Boundary scan: no remaining z-shell/.github workflow targets project zsh.
• python3 -B scripts/validate-agent-policy.py: passed.
• python3 -B -m unittest scripts/test_validate_agent_policy.py: 69 tests passed.
• git diff --check HEAD^ HEAD: passed.
• Child repository status: clean; local branch is one commit ahead of origin/main.
• Live HTTP checks: production aliases and restored immutable deployment return 200; the bad profile immutable deployment returns 404.
• trunk check .github/workflows was attempted. It reported 16 existing git-diff-check formatting failures across unaffected workflows; its unrelated codeql.yml autofix was reverted.

Blockers

• The prevention commit is local only. Until it is pushed and merged, a new push to z-shell/.github main can overwrite the wiki again.

Next steps

1. Push codex/fix-cloudflare-project-collision and open a PR to main.
2. Merge after repository checks pass.
3. Reconfirm both production aliases return HTTP 200. Rerun the wiki deployment only if another .github push overwrites production before the fix merges.

[ss-o]

Completion update

PR #491 was squash-merged to main as 5a0e9c6.

• Published main no longer contains .github/workflows/pages-deployment.yml.
• No remaining z-shell/.github workflow targets Cloudflare Pages project zsh.
• Post-merge CodeQL and CodeQL Advanced runs completed successfully.
• The merge commit triggered only the repository's CodeQL workflows, not a Cloudflare deployment.
• https://wiki.zshell.dev and https://zsh.pages.dev both return HTTP 200.

The prevention fix is published and there are no remaining incident blockers.