Route anonymous production traffic through the R2-only public reader

## Problem

The production homepage is served from an immutable R2 publication, but every HTML, CSS, and script request still enters the PHP-WASM execution Worker module. This makes public reads pay the startup cost of code they never execute.

Production measurements from ATL on 2026-07-29:

- homepage HTML: 0.18s to 0.94s total across five sequential requests
- theme CSS: 0.50s to 0.58s
- WordPress interactivity module: 0.52s
- navigation module: 0.45s
- execution Worker dry-run bundle: 8,384.92 KiB gzip
- existing R2-only public-reader dry-run bundle: 115.56 KiB gzip

The homepage response confirms `x-wp-codebox-page-cache-source: publication-r2`; storage lookup is not the architectural problem. Public requests are entering the wrong Worker boundary.

## Desired production contract

- Route anonymous published HTML and immutable publication assets through the existing R2-only public reader.
- Keep authenticated, preview, admin, REST, provisioning, operator, scheduled, and queue execution on the D1/PHP-WASM execution Worker.
- Preserve one canonical public origin so generated HTML and assets do not cross back into the execution Worker.
- Define deterministic fail-closed routing for unpublished or incomplete publication state.
- Measure cold and warm homepage plus asset latency before and after the routing change.

## Acceptance evidence

- Anonymous homepage and assets are served by a Worker bundle that imports no PHP-WASM, SQLite, D1, revision coordinator, or mutation code.
- Dynamic routes continue to reach the execution Worker with existing auth, persisted-data, queue, and response contracts.
- Reviewer-facing production timing records TTFB and complete page asset loading from the same region.

## AI assistance

OpenCode using OpenAI GPT-5.6 Sol gathered the production timing and bundle evidence and drafted this issue. Chris Huber remains responsible for the architecture and resulting implementation.

Inizia individuando il reader pubblico esistente che usa solo R2 e il confine di routing dell’execution Worker. Traccia come vengono separate le richieste anonime, autenticate, di preview, admin, REST, di provisioning, dell’operatore, pianificate e di queue. Il lavoro è completo quando i bundle pubblici escludono PHP-WASM e il relativo codice di esecuzione, le route dinamiche mantengono i propri contratti e le registrazioni dei tempi di produzione a freddo e a caldo coprono la homepage e gli asset.

Scritto dal modello di indicizzazione a partire dal testo della issue.