ci: cut prebuild API cost by ~99% (paginated gh api + curl asset fetch)

[widgetii]

Rethink of PR #12

The retry crutch treats the symptom. Real root cause: the prebuild consumes ~9000 API calls per fresh-cache run and loses the race against every other workflow sharing the org-wide installation-token bucket. Fix the greed, don't paper over the failures.

What was expensive

Step	Calls
gh release list --limit 200	~1 / source
gh release view <tag> × retention	~90 / source
gh release download <tag> --pattern sizes.*.json (per-asset API call inside)	~98 × 90 = ~8800 / source at cold cache
gh release download again for kconfig assets	~200 more
actions/configure-pages@v5 in pages.yml	1
Total	~9000 per source per fresh-cache run

What replaces it

• One paginated gh api /repos/<repo>/releases?per_page=100 per source. The response already carries body, assets[], and browser_download_url — so per-tag release view isn't needed. Even at 200-release retention this stays at ~2 calls per source.
• Asset bytes via anonymous HTTPS on browser_download_url, called with curl. On public repos this consumes zero of the installation token bucket — github.com's 302 to the CDN and the CDN fetch are both unauthenticated. curl's own --retry 5 --retry-delay 5 --retry-all-errors handles transient network flakes.
• actions/configure-pages@v5 dropped from pages.yml. Its only output was a Pages URL we don't consume (Vite base is hardcoded) and its only side-effect was another rate-limited API call. deploy-pages@v4 doesn't require it as long as Pages is enabled — which it is, source configured to build via GitHub Actions.

Net API budget

	Cold cache	Warm cache
Before	~9000 / source	~200 / source
After	~2 / source	~2 / source

Abstraction shape

New HttpFn type sits alongside GhFn; both are injectable so tests still drive runPrebuild deterministically without touching the network. GhReleaseDetail.assets[] gains an optional downloadUrl field.

Tests

• Rewrote makeGh mock to serve the paginated /releases endpoint (only endpoint the new prebuild hits).
• New makeHttp mock materialises asset content when the runtime curls at a browser_download_url that resolves in the fake set.
• New fetchReleases describe block: single-page early stop, multi-page pagination.
• 99 active tests pass locally.
• End-to-end build against the real OpenIPC/firmware/nightly-20260702-db82859 release fetched all 96 sizes shards + 192 kconfig files via curl and rebuilt the site cleanly.

Test plan

• npm test — 99 pass, 3 live skipped
• Local FORCE_REFETCH=1 npm run build against live releases — succeeds
• Dispatch on this branch (test+build green, deploy rejected by branch policy)
• Post-merge: watch the next 3 nightly runs; the 07:20–07:50 UTC bucket contention should no longer show up.

🤖 Generated with Claude Code