fix(ci): make the demo deploy job actually work

Two faults, both mine, both found only by running the deploy path rather than
just the substitution logic inside it.

The generated config was written to a temp directory, but wrangler resolves
`main` relative to the config file — so it went looking for /tmp/src/index.ts
and failed with "entry-point file not found". Generate it beside
wrangler.jsonc instead.

The route was declared as a custom domain, which asks Cloudflare to take over
the hostname's DNS record. It refuses while an ordinary A record exists, so
every deploy reported a partially-updated trigger config and exited non-zero —
enough to fail the job even though the Worker deployed fine. What actually
serves demo.nginxui.com is a zone route overlaying the existing proxied record,
so declare that. The config now matches reality and the deploy exits 0.

Verified by running the script against the image CI published: exit 0, the
demo still serves, and a base64url-encoded log path still reaches the
application rather than the WAF block page.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cloudflare/.gitignore

@@ -0,0 +1,3 @@
+
+# Generated by deploy-published.sh; removed on exit but never committed
+wrangler.published.jsonc

cloudflare/deploy-published.sh

@@ -30,7 +30,10 @@ case "$image" in
         ;;
 esac
 
-generated="$(mktemp -t wrangler-published-XXXXXX).jsonc"
+# Must live beside wrangler.jsonc, not in a temp directory: wrangler resolves
+# `main` and the container build context relative to the config file, so a
+# config in /tmp sends it looking for /tmp/src/index.ts.
+generated="wrangler.published.jsonc"
 trap 'rm -f "$generated"' EXIT INT TERM
 
 # Replace the local-build block with the published reference. Done with a

cloudflare/wrangler.jsonc

@@ -13,12 +13,19 @@
   // way to reach the demo when the custom domain's DNS is being changed.
   "workers_dev": true,
 
-  // demo.nginxui.com must already exist as a zone on this account. Wrangler
-  // takes over the DNS record when custom_domain is true.
+  // A zone route, not a custom domain. custom_domain: true asks Cloudflare to
+  // take over the hostname's DNS record, which it refuses while an ordinary A
+  // record exists ("already has externally managed DNS records") — so every
+  // deploy reported a partial trigger update and exited non-zero even though
+  // the Worker itself deployed fine.
+  //
+  // A route overlays the existing proxied record instead of replacing it, which
+  // is what is actually serving demo.nginxui.com today. Switching to
+  // custom_domain later means deleting that DNS record first.
   "routes": [
     {
-      "pattern": "demo.nginxui.com",
-      "custom_domain": true
+      "pattern": "demo.nginxui.com/*",
+      "zone_name": "nginxui.com"
     }
   ],