fix(cdn): announce cdn.build_complete from every build trigger

[ABB65]

Problem

cdn.build_complete was emitted from one place — the manual-rebuild endpoint (cdn/builds/trigger.post.ts). The push-triggered path (webhooks/github.post.ts → runCDNBuild) and its catch-up builds never emitted it.

That event is not a nicety. For a consuming site it is the entire cache-invalidation story: the delivery CDN is a data plane, and a site that caches its renders (ISR, durable edge cache, or a deploy-independent KV such as Netlify Blobs) keeps serving pre-build payloads until its own TTL lapses. A site redeploy does not fix it — those caches outlive deploys by design, which is exactly what "durable" and "shared blob store" mean.

Evidence (staging — Lanista/collabers)

The CDN itself was never wrong. Git ↔ R2 matched entry-for-entry, and the selective builds produced bundles byte-identical to a full rebuild's (164,616 B across both locales). But the site kept serving pre-save content until someone pressed Rebuild now.

webhook_deliveries shows why — 10 deliveries, all 10 matching a manual build, none for the ~10 push-triggered ones:

delivery	matching build
29 Jul 14:03:06	14:01:13 manual
17 Jul 01:11:09	01:09:25 manual
16 Jul 23:12:24	23:10:33 manual
16 Jul 16:15:58	16:14:09 manual
16 Jul 14:44:29	14:42:40 manual

cdn_builds mirrors it: every content session ends with a manual rebuild. The rebuild button was doing the purge, not the rebuild.

Change

Move the emit into runCDNBuild — the single path every trigger goes through — so manual, webhook and catch-up builds all announce themselves. Catch-up builds move the CDN to a newer commit, so they need it just as much.

• Payload shape unchanged — consumers parse those fields.
• A clean 0-file no-op (the content-less push short-circuit from fix(cdn): skip content-less builds so the manifest never outruns the bundle #153) stays silent: nothing was published, so nothing needs purging.
• Failed builds are still announced so the consumer can react.
• The manual endpoint no longer emits directly, so there is no double-emit.

Tests

4 new runner tests: push-triggered emit, catch-up emit, failed-build emit, no-op silence. The integration test now asserts the endpoint delegates workspaceId and does not emit directly.

pnpm test 1095/1095 · pnpm lint 0 errors · nuxt typecheck clean.

Not in this PR

Two ordering issues found in executeCDNBuild while tracing this, both real but separate:

1. _manifest.json is uploaded first and _bundle/*.json last — measured 105 s apart on a full rebuild (R2 LastModified 11:01:19 → 11:03:04), ~24 s on a selective one. For that window the CDN advertises a content version it has not published yet.
2. _media_manifest.json is deleted by the step-7 sweep (it is not in uploadedPaths until step 8) and re-uploaded ~1 s later. The SDK throws on non-2xx and MediaAccessor caches the result for the instance's lifetime, so a lambda booting in that window is poisoned for good.