A preview for every pull request

A reviewer reads a diff and imagines the screen. For anything visual that is a guess, and KB-5 and KB-6 are not things a diff shows you.

Acceptance criteria

• Every push to an open pull request builds with --base=/tt-nn/ and publishes to the matching key prefix. No source file changes to support this
• The prefix is the issue key from the branch name, lowercased. The hooks already guarantee the key is there
• The workflow comments the URL on the pull request once and edits that same comment on later pushes, rather than adding one per push
• Publishing a preview never writes outside its own prefix
• Everything in a preview is served no-cache
• Closing the pull request deletes the prefix and invalidates it — on closed, so an abandoned branch is cleaned up as surely as a merged one
• Teardown of a prefix that is already gone succeeds rather than failing the workflow
• A fork's pull request does not get AWS credentials, and says so instead of failing with a permissions error
• The environment these jobs use has no required reviewers on it. A protected environment holds every push waiting for an approval to publish a preview that nobody can look at yet

Notes

The ask was teardown on merge. Teardown on close, because a pull request that is abandoned leaks a prefix that nothing will ever remove, and those accumulate quietly.

Two open pull requests on one issue key share a prefix and the later push wins. Accepted — KB-7 has the reasoning.