feat(release-service): scaffold Worker foundation

[ascorbic]

What does this PR do?

Implements W5.1 and the foundation-only portion of W5.8 from the delegated release plan. It scaffolds the Cloudflare release-service Worker with D1, Queue/DLQ, cron, static asset, generated type, and fail-closed configuration foundations. It also adds shared versioned API envelopes, stable errors, request IDs, security primitives, owner checks, publisher policy, opaque pagination, and OpenAPI generation.

Only GET /health is reachable. OAuth custody, CI submission, approval, rejection, and publication routes remain absent until their gated lifecycle slices land.

Part of #1908 and implements the approved protocol in #1870.

Closes: N/A, integration work for #1908.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs. N/A: no admin UI changes.
• I have added a changeset (if this PR changes a published package). N/A: apps/release-service is private.
• New features link to an approved Discussion. N/A: maintainer-owned implementation of approved RFC RFC: Attested Automated Publishing #1870 under umbrella Delegated release service #1908.

AI-generated code disclosure

• This PR includes AI-generated code, model/tool: OpenCode with GPT-5.6-sol plus independent second-opinion and review agents.

Screenshots / test output

No visual changes.

• Full monorepo build and typecheck pass.
• Release service: 45 workers-vitest tests pass.
• Worker production build and Wrangler deploy dry-run pass.
• Generated Worker types are current.
• Frozen lockfile install, type-aware lint, formatting, and diff checks pass.

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks feat/delegated-release-service-13-service-scaffold. Updated automatically when the playground redeploys.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7b79aa7

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Scope check

This PR changes 15,765 lines across 22 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	emdash-demo-cache	7b79aa7	Jul 12 2026, 08:17 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	7b79aa7	Jul 12 2026, 08:16 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	emdash-demo-do	7b79aa7	Jul 12 2026, 08:16 AM

[emdashbot]

This PR scaffolds the new apps/release-service Cloudflare Worker with a fail-closed foundation: fail-closed configuration parsing, versioned {data|error, requestId} API envelopes, stable error codes, request-ID validation, CORS/CSRF/security primitives, owner/authorization helpers, opaque pagination cursors, and OpenAPI generation. Only GET /health is wired up; the rest of the lifecycle routes are deliberately deferred to follow-up slices.

Approach assessment: The change is tightly-scoped to the approved delegated-release RFC (#1870) and umbrella issue #1908. It adds a private app rather than touching published packages, so no changeset is needed. It follows the existing apps/ conventions (compare apps/aggregator) and uses the same tsgo/vitest-pool-workers/Wrangler toolchain. The fail-closed defaults in wrangler.jsonc and the success/error envelopes are appropriate for a security-sensitive release service.

What I checked:

• All 22 changed files in apps/release-service, plus workspace integration (pnpm-workspace.yaml includes apps/*).
• Configuration validation, CORS/CSRF, pagination, auth/owner helpers, request handling, queue/cron fallbacks, and OpenAPI schema generation.
• Tests cover health, fail-closed config, async error handling, blocked paths, static-asset fallback, pagination round-trips, and security rejection cases.
• AGENTS.md conventions: no admin UI/Tailwind/Lingui concerns here, no SQL, no locale-filtered content queries, import paths use .js, internal import type is used, changeset correctly skipped for a private app.

Headline conclusion: No logic bugs, security regressions, or convention violations found in this scaffold. The biggest remaining risk is that future slices must actually wire the OAuth, approval, and publication routes into these foundations rather than letting them remain stubs, but that is explicitly out of scope. Static review only — I did not run the test suite, typecheck, or build.