Route anonymous production traffic through the R2-only public reader

## Problem

The production homepage is served from an immutable R2 publication, but every HTML, CSS, and script request still enters the PHP-WASM execution Worker module. This makes public reads pay the startup cost of code they never execute.

Production measurements from ATL on 2026-07-29:

- homepage HTML: 0.18s to 0.94s total across five sequential requests
- theme CSS: 0.50s to 0.58s
- WordPress interactivity module: 0.52s
- navigation module: 0.45s
- execution Worker dry-run bundle: 8,384.92 KiB gzip
- existing R2-only public-reader dry-run bundle: 115.56 KiB gzip

The homepage response confirms `x-wp-codebox-page-cache-source: publication-r2`; storage lookup is not the architectural problem. Public requests are entering the wrong Worker boundary.

## Desired production contract

- Route anonymous published HTML and immutable publication assets through the existing R2-only public reader.
- Keep authenticated, preview, admin, REST, provisioning, operator, scheduled, and queue execution on the D1/PHP-WASM execution Worker.
- Preserve one canonical public origin so generated HTML and assets do not cross back into the execution Worker.
- Define deterministic fail-closed routing for unpublished or incomplete publication state.
- Measure cold and warm homepage plus asset latency before and after the routing change.

## Acceptance evidence

- Anonymous homepage and assets are served by a Worker bundle that imports no PHP-WASM, SQLite, D1, revision coordinator, or mutation code.
- Dynamic routes continue to reach the execution Worker with existing auth, persisted-data, queue, and response contracts.
- Reviewer-facing production timing records TTFB and complete page asset loading from the same region.

## AI assistance

OpenCode using OpenAI GPT-5.6 Sol gathered the production timing and bundle evidence and drafted this issue. Chris Huber remains responsible for the architecture and resulting implementation.

Start by locating the existing R2-only public reader and the execution Worker routing boundary. Trace how anonymous, authenticated, preview, admin, REST, provisioning, operator, scheduled, and queue requests are separated. Done means public bundles exclude PHP-WASM and related execution code, dynamic routes retain their contracts, and cold and warm production timing records cover the homepage and assets.

Written by the indexing model from the issue text.