Enforce canonical hosted release origin

[0thernet]

Summary

• enforce the one-shot hosted SITE_URL as exactly https://hra.sh and reject staging or trailing-slash variants
• document both release commit points and require provider readback before cleanup
• update the durable plan with exact CI, Convex, Vercel, cron, and release evidence without overclaiming accepted N
• move checkout and artifact actions to reviewed Node 24 releases pinned by immutable SHA, with regression ownership of every release action reference

Verification

• bun run check
• 865 tests, 14,719 assertions
• KB percolate, refresh, and check
• three independent runbook reviewers and two workflow reviewers: no remaining P0, P1, or P2 findings

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hra	Ready	Preview	Aug 23, 2026 7:58pm