Route anonymous production traffic through the R2-only public reader

## Problem

The production homepage is served from an immutable R2 publication, but every HTML, CSS, and script request still enters the PHP-WASM execution Worker module. This makes public reads pay the startup cost of code they never execute.

Production measurements from ATL on 2026-07-29:

- homepage HTML: 0.18s to 0.94s total across five sequential requests
- theme CSS: 0.50s to 0.58s
- WordPress interactivity module: 0.52s
- navigation module: 0.45s
- execution Worker dry-run bundle: 8,384.92 KiB gzip
- existing R2-only public-reader dry-run bundle: 115.56 KiB gzip

The homepage response confirms `x-wp-codebox-page-cache-source: publication-r2`; storage lookup is not the architectural problem. Public requests are entering the wrong Worker boundary.

## Desired production contract

- Route anonymous published HTML and immutable publication assets through the existing R2-only public reader.
- Keep authenticated, preview, admin, REST, provisioning, operator, scheduled, and queue execution on the D1/PHP-WASM execution Worker.
- Preserve one canonical public origin so generated HTML and assets do not cross back into the execution Worker.
- Define deterministic fail-closed routing for unpublished or incomplete publication state.
- Measure cold and warm homepage plus asset latency before and after the routing change.

## Acceptance evidence

- Anonymous homepage and assets are served by a Worker bundle that imports no PHP-WASM, SQLite, D1, revision coordinator, or mutation code.
- Dynamic routes continue to reach the execution Worker with existing auth, persisted-data, queue, and response contracts.
- Reviewer-facing production timing records TTFB and complete page asset loading from the same region.

## AI assistance

OpenCode using OpenAI GPT-5.6 Sol gathered the production timing and bundle evidence and drafted this issue. Chris Huber remains responsible for the architecture and resulting implementation.

Comienza localizando el lector público existente que solo usa R2 y el límite de enrutamiento del execution Worker. Traza cómo se separan las solicitudes anónimas, autenticadas, de preview, de administrador, REST, de provisioning, de operador, programadas y de queue. Se considera terminado cuando los bundles públicos excluyen PHP-WASM y el código de ejecución relacionado, las rutas dinámicas conservan sus contratos y los registros de tiempos de producción en frío y en caliente cubren la página de inicio y los assets.

Escrito por el modelo de indexación a partir del texto del issue.