fix(docs): preserve versioned archives during stable deployment - #119

Summary

Closes #118.

Retain published versioned documentation when replacing the stable Engineer site. Read the existing website release archives using the existing deployment credential, stage those archives with the new stable site, and keep the clean build separate for the new versioned upload. Missing inputs fail before deployment. No runtime, package metadata, dependency, credential scope or published 0.2.0 artifact changes.

The exact old 0.1.6 archive has also been restored separately from its verified original Git tree. Its live version/source markers, linked pages and stylesheets pass, as do the unchanged current and versioned 0.2.0 docs.

Regression and verification

• Base: 7b53244. The regression executes the actual release workflow inputs through the real pinned deployment entrypoint and an isolated local Git destination. It fails because the deployed old archive no longer exists: one failure in 0.97 seconds.
• Fix: 976382a. The deployment regression and staging suite pass: nine tests. Checks include hidden/binary bytes, multiple old versions, stable/new-version identities, no nested archives, obsolete stable-page removal, and preservation of another library.
• The vendored entrypoint is byte-identical to the actual upstream action at 55306faa4ed53b815ae49e564af8cfb359d32ae2, SHA256 4b271e42f26cb92d4133a1f128ac0db2d39031ffb209e6c49a31634df28c87fb. Its upstream license is retained.
• Full local suite: 5,679 passed, 57 configured performance tests deselected, 17 warnings, with NUMBA_DISABLE_JIT=1. Project and release-critical coverage thresholds pass: 95.98% lines and 90.56% branches.
• Ruff lint, 417-file format check, ty, all-file hooks, actionlint, lock consistency, strict MkDocs, executable documentation, README links, wheel/sdist build, import and explicit Twine checks pass.
• Actual hosted candidate commit 66234dc has exactly the reviewed source tree f0397a8bbd27e50880e88250be1eaadd4dbe87e0. Its downloaded archive matches the GitHub digest, both distribution hashes verify, and a clean copied installation passes all 209 package bytes/origins plus the real source-contamination negative control. All 209 runtime files and Requires-Dist are identical to published 0.2.0. This is an unpublished development qualification artifact, not another release.
• All 49 hosted final-head checks completed: 48 success and one configured Python 3.15 exception skip. Actual installed, native and shared qualification matrices passed across supported platforms. Two result records were stuck during the GitHub Actions result-processing incident; targeted reruns at the unchanged head recovered both, and the final package gate passed. No gate bypass or old-revision substitution.

AI assistance

Codex reproduced the actual deployment failure, implemented and reviewed the retained repair, refreshed it against current main, restored the verified historical archive and prepared these tests and notes. Verification uses the producing workflow/action and actual published identities, not a mock of the staging logic.