publish gui.hanzo.ai to the Sites plane, not to Pages

The build already produced a static export at apps/gui-docs/out; only the last
step differed from every other site we serve. It uploaded that directory to a
Cloudflare Pages project, which made gui.hanzo.ai the one host in the hanzo.ai
zone still resolving off our own ingress — 1 record of 150, measured. A page
published there cannot be rebuilt or rolled back from here.

The site action is the one publish path: it reads the deploy credential from
KMS at run time and syncs to s3://hanzo-sites/hanzo/gui, which universe's
gui-static route serves. That removes the Cloudflare token read and the wrangler
project-create step with it — two things to hold and rotate, for a step that is
now one action.

Trigger narrowed to main. --production-branch=main made a push to any other
branch a Pages preview; the Sites plane keeps one prefix per slug, so leaving
`dev` in the list would have let a side branch overwrite what is live. No dev
branch exists on either remote today, which is what makes this safe to state
rather than guess.

.hanzo/workflows/deploy-gui-docs.yml

@@ -1,8 +1,23 @@
 name: Deploy GUI Docs
 
+# gui.hanzo.ai, served from the object-store plane.
+#
+# `pnpm build --filter=gui-docs` writes a static export to apps/gui-docs/out, so
+# the site action syncs that directory to s3://hanzo-sites/hanzo/gui and the
+# `gui-static` route in universe serves it. No image, no pod.
+#
+# The host resolved to a Cloudflare Pages project, which was the last DNS record
+# in the hanzo.ai zone that did — everything else already answers from our own
+# ingress on the *.hanzo.ai wildcard. A page published there could not be
+# rebuilt or rolled back from here.
+#
+# main only. The Pages deploy passed --production-branch=main, which made a push
+# to any other branch a preview; the Sites plane has one prefix per slug, so the
+# same trigger would have let a side branch overwrite what is live.
+
 on:
   push:
-    branches: [main, dev]
+    branches: [main]
     paths:
       - 'apps/gui-docs/**'
       - 'packages/**'
@@ -10,14 +25,15 @@ on:
       - '.hanzo/workflows/deploy-gui-docs.yml'
   workflow_dispatch:
 
+concurrency:
+  group: deploy-gui-docs
+  cancel-in-progress: false
+
 jobs:
   deploy:
     runs-on: hanzo-docs-build-linux-amd64
     permissions:
       contents: read
-      deployments: write
-      pages: write
-      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -31,53 +47,11 @@ jobs:
         env:
           NODE_OPTIONS: '--max-old-space-size=8192'
 
-      - name: Fetch CF credentials from KMS
-        id: kms
+      - name: Publish to the Sites plane
+        uses: https://git.hanzo.ai/hanzoai/ci/.github/actions/site@v1
+        with:
+          slug: gui
+          dir: apps/gui-docs/out
         env:
           KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
           KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
-          KMS_ENDPOINT: ${{ vars.KMS_ENDPOINT || 'https://kms.hanzo.ai' }}
-          KMS_SECRET_ENV: ${{ vars.KMS_SECRET_ENV || 'prod' }}
-        run: |
-          # Canonical Hanzo KMS (/v1/kms): machine-identity login -> bearer,
-          # then read CF Pages deploy creds from deploy/<NAME>.
-          #
-          # FLAT path, and the org rides on the TOKEN. The older
-          # /v1/kms/orgs/<org>/secrets/... form is answered by a DIFFERENT
-          # instance whose copy is stale, and it nests the value under
-          # .secret.value -- so this step read the wrong service and failed
-          # closed. deploy.yml in this repo has always used the flat form.
-          # Replaces the decommissioned Infisical /api routes (forwards-only).
-          token=$(curl -fsS "${KMS_ENDPOINT}/v1/kms/auth/login" \
-            -H 'Content-Type: application/json' \
-            -d "{\"clientId\":\"${KMS_CLIENT_ID}\",\"clientSecret\":\"${KMS_CLIENT_SECRET}\"}" \
-            | jq -r '.accessToken // empty')
-          if [ -z "${token}" ]; then
-            echo "::error::KMS login failed at ${KMS_ENDPOINT}/v1/kms/auth/login (check KMS_CLIENT_ID/KMS_CLIENT_SECRET)."
-            exit 1
-          fi
-          kms_get() {
-            curl -fsS "${KMS_ENDPOINT}/v1/kms/secrets/deploy/$1?env=${KMS_SECRET_ENV}" \
-              -H "Authorization: Bearer ${token}" | jq -r '.value // empty'
-          }
-          cf_token=$(kms_get CLOUDFLARE_API_TOKEN)
-          cf_account=$(kms_get CLOUDFLARE_ACCOUNT_ID)
-          if [ -z "${cf_token}" ] || [ -z "${cf_account}" ]; then
-            echo "::error::No CLOUDFLARE_API_TOKEN/CLOUDFLARE_ACCOUNT_ID at ${KMS_ENDPOINT}/v1/kms/secrets/deploy (env ${KMS_SECRET_ENV})."
-            exit 1
-          fi
-          echo "::add-mask::${cf_token}"
-          echo "::add-mask::${cf_account}"
-          echo "cf_token=${cf_token}" >> "$GITHUB_OUTPUT"
-          echo "cf_account=${cf_account}" >> "$GITHUB_OUTPUT"
-
-      - name: Create Cloudflare Pages project (if needed)
-        continue-on-error: true
-        run: npx wrangler pages project create gui-docs --production-branch=main
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}
-      - run: npx wrangler pages deploy apps/gui-docs/out --project-name=gui-docs --commit-dirty=true
-        env:
-          CLOUDFLARE_API_TOKEN: ${{ steps.kms.outputs.cf_token }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ steps.kms.outputs.cf_account }}