ci: make docs previews production-ready

[UnArbosFive]

Summary

• split untrusted building from trusted deployment so PR-controlled code never runs on a runner holding the Vercel token
• audit the dedicated preview project before deployment: automatic system variables disabled, OIDC disabled, no protection bypasses or integrations, no Preview environment variables, and the wildcard domain verified
• disable Git-triggered Vercel deployments for non-main branches on the legacy production project while explicitly preserving main production deployments
• pin trusted controls to the immutable workflow commit and accommodate the audited Vercel root directory during prebuilt deployment
• reconcile preview removal on docs reverts and PR closure without path-filter gaps, while treating aliases owned by another project as a safe no-op
• use Vercel’s documented deployment-list endpoint and add bounded job timeouts plus regression coverage for stale runs, security settings, cleanup, and root-directory handling

Target branch

This PR is rebased onto #2968 and targets its release-v438 branch. That branch contains the docs-preview implementation this production-readiness patch builds on.

The trusted workflow_run half and the Git auto-deployment cutoff are intentionally loaded from the default branch. These controls become active after this version propagates to main.

CI scope

This PR changes only the docs-preview control scripts, workflows, tests, and the website Vercel deployment policy. CI should be evaluated against the current #2968 head; the docs-preview trust-boundary and secret-free build checks exercise this patch directly.

Validation

• 62 docs-preview unit and policy tests
• Ruff, Actionlint, JSON/YAML parsing, and diff checks
• exact locked Vercel CLI 57.0.0 install and npm audit --audit-level=high --omit=dev: 0 vulnerabilities
• token-free local Vercel production build: TypeScript passed and 2,486 pages generated
• 785 MB sealed artifact round trip: validated extraction with zero remaining symlinks
• exact PR head passed the GitHub security-policy check and the complete secret-free build, seal, and artifact-upload workflow
• protected follow-up run authenticated and extracted the artifact, audited the configured project, rechecked the PR head, and reached deployment; current main then reproduced the missing root-directory failure fixed here
• local mock API confirmed the corrected prebuilt CLI reaches POST /v13/deployments with the audited root-directory stub
• reproduced the linked cleanup failure for a foreign alias and added a regression test proving it is left untouched without failing the workflow

Deployment prerequisite

The dedicated preview project must have automatic system environment variables disabled, OIDC token generation disabled, no protection bypasses, and no attached integrations. The workflow verifies these settings and fails before deployment if any condition is not met.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
subtensor	Ready	Preview	Aug 3, 2026 11:16am

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

VERY HIGH account-age scrutiny; repository admin with substantive merged history, no Gittensor association; fix/docs-preview-production-readiness → release-v438.

Static analysis found that the PR-specific changes preserve separation between untrusted builds and credential-bearing deployment, pin trusted controls to the immutable workflow commit, and fail closed on stale heads and unsafe Vercel configuration. The AI-review trust-boundary files are unchanged.

Findings

No findings.

Conclusion

No malicious behavior or security vulnerability was found in the PR-specific delta.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👍

UNKNOWN Gittensor association; very new account but repository admin with substantial merged contribution history, warranting heightened scrutiny of the CI trust boundary.

The implementation matches the substantive PR description. It keeps PR-controlled builds separate from credential-bearing deployment, pins trusted controls to the immutable workflow commit, validates the Vercel project configuration, reconciles obsolete previews, and adds focused regression coverage.

No runtime/spec-version implications or duplicate open PRs were identified. The reported targeted validation is proportionate to these workflow and control-script changes.

Findings

No findings.

Conclusion

The production-readiness changes are coherent and fail closed at the relevant trust boundaries. No blocking domain issues were found.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍