cdn.uhhm.no is real: releases publish to the git-pages CDN

The advertised import URL now exists. The CDN is just a pages site
(PAGES.md pattern): DNS + allowlist TXT in terraform, _headers for CORS
and immutable caching, and the release workflow PATCHes each version's
bundle in — incremental, so old versions persist. Verified in real
Chromium importing buuh@8.0.0 from the live CDN via an import map.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014NgfSjHE11oFpoSnLVKLXd

.gitea/workflows/release.yml

@@ -42,3 +42,19 @@ jobs:
             -H "Authorization: token ${{ secrets.PACKAGES_TOKEN }}" \
             --upload-file dist-cdn/buuh.js.map \
             "https://project.uhhm.no/api/packages/uhhm/generic/buuh-cdn/${VERSION}/buuh.js.map"
+
+      - name: publish to cdn.uhhm.no (git-pages, incremental)
+        run: |
+          VERSION="${GITHUB_REF_NAME#v}"
+          mkdir cdn
+          cp dist-cdn/buuh.js "cdn/buuh@${VERSION}.js"
+          cp dist-cdn/buuh.js.map "cdn/buuh@${VERSION}.js.map"
+          cp dist-cdn/buuh.js cdn/buuh.js
+          cp dist-cdn/buuh.js.map cdn/buuh.js.map
+          tar -czf cdn.tar.gz -C cdn .
+          # PATCH = incremental: earlier versions stay published forever
+          curl --fail -sS -X PATCH "https://cdn.uhhm.no/" \
+            -H "Content-Type: application/x-tar+gzip" \
+            -H "Forge-Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            --data-binary @cdn.tar.gz \
+            -w "cdn: %{http_code}\n"