Publish main to the live site

A merge to main tags a version and cuts a release. It does not put anything anywhere.

Acceptance criteria

• A job in main.yml builds and publishes, gated on checks the same way release already is. A failing check publishes nothing
• Authentication is OIDC into the publish role from TT-41, not the infrastructure role. The bucket, distribution and URL are read from the GitHub Actions environment. No access keys in secrets
• Two sync passes: assets/ with max-age=31536000, immutable first, then everything else with no-cache. Index last, so it is never newer than the assets it names
• The delete pass excludes tt-*/*. A plain sync --delete removes every open pull request's preview, silently, and the failure shows up on someone else's branch
• A CloudFront invalidation follows, covering the unhashed files
• Re-running the workflow on a commit that already published is harmless

Showing the version

• The version the build was cut at appears at the bottom of the left nav rail, in white, so what is live can be identified without guessing
• White is --chrome-ink, the existing token — not a hardcoded #FFF. The rail is the dark chrome zone and has its own ink scale
• It reads v0.7.0. Mono, --t-figure, the same token the nav counts already use
• It is pinned to the bottom of the rail rather than following the last row, so it does not move as rows are added
• It is not focusable and is not inside a nav row, so the rows' accessible names are unchanged. NavRail.test.tsx asserts those exactly and must still pass untouched
• It is not hidden from assistive technology. A version string is the first thing anyone reporting a defect will be asked for
• A build with no tag renders nothing rather than undefined or v. Local npm run dev and every preview build are untagged, so this is the common case in development, not the edge one

Notes

The version reaches the bundle as a build-time constant. There is no runtime config and nothing to fetch.

This makes release and publish share a fact. Lift the version calculation out of the release job into its own job that both depend on, rather than making publish wait on tagging — a tagging failure should not stop the site going out, and two jobs each working the number out for themselves is two chances to disagree. The lifted job outputs a version either way: the tag already on the commit if there is one, the next tag if not.

This is the one part of the epic that touches src/. It is a change to src/shell/NavRail.tsx and its stylesheet, so it is ui-developer's work under KB-5, not infra's.