Make CDN artifact rewrites deploy more seamlessly

[timkelty]

Currently, artifact cache keys are based on the bucket object path, which includes the build ID, even when accessed through a rewrite. For rewrites targeting the current build, deploying changes the cache key. Older pages requesting hashed assets can therefore receive 404s, even if the previous build’s files remain cached.

Build-specific public URLs avoid this, but require additional build and URL configuration. We should consider an opt-in cache rule that overrides the cache key, for example using the incoming URL instead of the bucket object path.

This would allow cached hashed assets to remain reachable across deployments, provided those entries aren’t purged. It wouldn’t prevent 404s on cache misses, and fixed filenames would need appropriate expiration or invalidation.