Wire the handoff deploy-site.yml says is wired

deploy-site.yml's header states the build-to-deploy handoff runs through the
Hanzo Platform GitHub App and .platform.yml, and adds that "until that webhook
is live this workflow just publishes the image". There was no .platform.yml in
this repo, so the second half was the permanent state and nothing said so: the
image built green, ghcr.io/hanzoai/papers took a fresh tag today at 19:32, and
papers.hanzo.ai went on serving the build before it. A pipeline that publishes
and does not roll is not a slow deploy, it is a missing one, and the only
evidence was a 404 on a paper nobody could fetch.

tag-pattern is the git tag, matching app, gallery and playground. The branch
build publishes `main` and a SHA; floating tags never reach a cluster, so that
image was never going to move the site whatever else was wired.

amd64 alone, for the reason recorded beside the same decision in hanzo.yml: the
context is `site`, the door refuses a context below the repo root, and delegate
is the only road to a second architecture.

.platform.yml

@@ -0,0 +1,24 @@
+# Platform-native CI/CD — hanzoai/papers (papers.hanzo.ai)
+#
+# deploy-site.yml builds the image and says, in its own header, that the
+# build→deploy handoff is "wired via the Hanzo Platform GitHub App +
+# .platform.yml". There was no .platform.yml. So the image published and
+# nothing rolled: ghcr.io/hanzoai/papers carried a fresh `main` tag while
+# papers.hanzo.ai kept serving the build before it, and no step anywhere was
+# red about it.
+#
+# amd64 alone, and the reason is in hanzo.yml beside the same decision: this
+# image's context is `site`, the build door refuses a context below the repo
+# root, so `mode: delegate` — the only road to a second architecture — is shut
+# until the context is rooted.
+build:
+  matrix:
+    - { os: linux, arch: amd64 }
+  dockerfile: site/Dockerfile
+  context: site
+  image: ghcr.io/hanzoai/papers
+  # A semver image, from a semver git tag. The branch build publishes `main`
+  # and a SHA, and a floating tag never reaches a cluster — which is the other
+  # half of why the site did not move.
+  tag-pattern: "{{git.tag}}"
+  push: true