toolkit merge: CLI docs website to release-gated Cloudflare

[BYK]

Sub-task of the toolkit monorepo merge (master issue linked below). Plan: https://gist.github.com/BYK/8c0ce6cec64608f41fe5654b7827228e

Move CLI docs website to release-gated Cloudflare (off GitHub Pages).

• apps/cli-docs builds Astro + Sentry sourcemap upload (unchanged upstream).
• New Craft cloudflare target, release-gated (Pages wrangler pages deploy OR Worker static assets). Coordinate with Support Cloudflare deploy target + prefixed multi-product releases (for getsentry/toolkit) craft#842.
• Move cli.sentry.dev DNS from GitHub Pages to Cloudflare.
• Ensure /install stays reachable at cli.sentry.dev/install (installer + README hardcode it).
• Replace rossjrw/pr-preview-action with Cloudflare preview deployments.

See §6.

[BYK]

Master tracking issue: #1248

[BYK]

Hey Jared, sup?

[jared-outpost]

hey! all good. i've got the task loaded — move apps/cli-docs off GitHub Pages to release-gated Cloudflare, add the Craft cloudflare target (coordinating with getsentry/craft#842), migrate the cli.sentry.dev DNS, keep /install reachable, and swap the PR-preview action for Cloudflare preview deploys.

want me to start on it? if so, one thing to confirm: should i target Pages (wrangler pages deploy) or a Worker with static assets? the issue lists both — i'll default to Pages unless you'd rather go Worker.

[BYK]

Worker with static assets as pages are deprecated. I'll handle the DNS changes once you have things set up

[jared-outpost]

opened #1354 (draft) for the Cloudflare migration — Worker with static assets, as you specified.

one snag: my GitHub App token doesn't have the workflows permission, so i couldn't push the .github/workflows/* and .craft.yml changes — GitHub rejects those. the PR branch has the pushable parts (wrangler.jsonc, wrangler devDep, lockfile), and the full tested diff for the workflow/craft changes is embedded in the PR description (in an HTML comment at the bottom) for you to apply with a workflows-scoped push.

what's in the workflow diff:

• docs-deploy.yml (new): build + sourcemap upload + wrangler deploy, gated on release: published — keeps docs tied to the published release, same guarantee the old craft gh-pages target gave.
• docs-preview.yml: wrangler versions upload preview + PR comment, replacing rossjrw/pr-preview-action and all the gh-pages umbrella/cleanup machinery.
• .craft.yml: drop the gh-pages target + artifact.
• ci.yml: build-docs stops packaging the gh-pages artifact (build + sourcemap upload unchanged, per the "unchanged upstream" note).
• deletes cleanup-doc-previews.yml, public/CNAME, orphaned .nojekyll.

verified locally: docs build with DOCS_BASE_PATH=/, wrangler deploy --dry-run reads all 333 assets (/install + 404.html present), all workflow YAML parses, check:stale-refs/check:deps pass. /install stays at cli.sentry.dev/install.

needs CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID in the production environment, and the first preview versions upload needs the Worker to exist (first prod deploy creates it) — worth bootstrapping alongside the DNS move you're handling.

if you'd rather grant the app workflows and let me push directly, i can fold everything into the one branch and drop the split.