[ElmanCod110]

Summary

This change set focuses on making the existing TeamCode Hub workspace load and behave consistently, and on making CI/CD safer and more diagnosable.

Asset delivery and product UI

• Add a locked-down repository-root hosting fallback and explicit CSS/JavaScript MIME types and cache headers.
• Refresh versioned asset keys and define missing workspace token aliases.
• Connect the sidebar team shortcut to the real Teams page and remove non-functional demo-only UI and assets.

CI reliability and regression coverage

• Run workspace UI contract tests, production JavaScript syntax checks, PHP smoke tests, and MariaDB integration tests on PHP 8.2, 8.3, and 8.4.
• Fix the workspace contract assertion to match idempotent CREATE TABLE IF NOT EXISTS migration statements.
• Keep the design-system import checks aligned with the current cache keys and stop checking a deleted demo JavaScript file.
• Avoid duplicate push-triggered checks on topic branches; PRs validate topic branches and push-triggered CI runs on main.
• Bound CI job duration and update checkout to the Node 24-compatible action version.

Controlled manual delivery

• Add .github/workflows/deploy.yml, a manual-only SSH deployment workflow restricted to main and explicit DEPLOY confirmation.
• Require pinned SSH host verification, a narrow absolute target path, and a production environment; use non-destructive rsync.
• Add CI contract tests for deployment safeguards and document required environment secrets.
• Database migrations and administrator bootstrap are deliberately not run automatically during deployment.

Validation status

Earlier failed CI runs were traced to the workspace UI contract assertion, stale design-system import expectations, and a JavaScript syntax step that still referenced the removed demo script. These have been addressed in subsequent commits. The latest run exposed one additional test-only defect: PHP interpolated $request and $params inside a double-quoted assertion, so the assertion now uses literal single-quoted strings. The new head's CI run is still queued, so the current head is not yet verified green. The deployment workflow cannot be exercised until production environment secrets and a staging-tested target are configured.

Commit history

This branch uses separate purpose-specific commits. Merge with a merge commit or rebase, not squash, to preserve the requested commit history. Do not merge until the latest checks pass.