Phase 1 aggregate broadcast (VPS-served): worker → static JSON + revalidate hook

[Flotapponnier]

Self-hosted variant of the SRH replacement roadmap (pivoted from #1297 which used Vercel Blob).

What this PR does

• worker/publish-aggregate.ts (new): after each Tier A sweep, reads back all 68 unfiltered bench snapshots from Redis via TCP direct (never SRH), assembles a { v, builtAt, benches[] } envelope, atomic write to ${AGGREGATE_OUTPUT_PATH}/latest.json (write to .tmp then rename so readers never see torn snapshots).
• worker/index.ts: calls publishAggregate(specs) after tier A. No-op unless AGGREGATE_OUTPUT_PATH is set — staged rollout.
• src/app/api/internal/revalidate-aggregate/route.ts (new): POST endpoint, bearer token via REVALIDATE_TOKEN (timing-safe compare), calls revalidateTag('bench-aggregate', 'default').

Why VPS-served (not Vercel Blob)

• $0/mo instead of ~$10/mo
• Data stays on operator infra (no third-party crossing)
• No 60 s Blob overwrite propagation window (Caddy just serves the fresh file)
• Same reverse proxy already serves kv.openchainbench.com — one config, one TLS cert
• No new vendor dependency; can Cloudflare-front later for global edge cache if desired

Zero user-visible effect until env is provisioned

Site's read path unchanged (still loadAllBenchmarksSafe → Redis via SRH). Worker gains one atomic file write and one HTTP POST per cycle. Both fail-soft.

Follow-up ops (I'll do these myself after merge)

1. Add aggregate matcher to /opt/ocb/Caddyfile (path-based route on kv.openchainbench.com/aggregate/* → static file server)
2. Bind mount /data/state/aggregate in worker + caddy containers via docker-compose
3. Provision envs on worker + site
4. Rebuild worker container
5. Observe 24-48h, then Phase 2 PR flips reader to fetch the aggregate URL