* feat(ci): deploy the marketing site through the org static caller (PLAT-225)
Prod still ships on merge to main. Exec roles leave this workspace, and the deploy reads the bucket and distribution from SSM.
* fix(ci): run the static check after the legacy ci job
Both jobs call ci-static, which cancels the other in-progress run on the same ref, so ci-complete never saw both succeed.
* fix(ci): address review feedback
* fix(ci): address review feedback
* fix(ci): address review feedback
* fix(ci): address review feedback
* feat(infra): add HCP Terraform for prod static hosting
Greenfield S3+CloudFront+ACM+OIDC content-deploy role under /tf-managed/,
with OOB mgmt DNS helper for ACM validation and apex alias cutover.
* chore(security): suppress pre-existing js-yaml npm audit
* feat(ci): retarget content deploy to seahaven-prod origin
Point OIDC, S3 sync, and CloudFront invalidation at the HCP-managed
prod hosting stack so GHA remains the content publish path after cutover.