Add Workers static assets support to the Cloudflare preview action

Context

The org is migrating lecture PR previews from Netlify to Cloudflare
(QuantEcon/infrastructure#4). Cloudflare's investment has moved from Pages
to Workers static assets (Pages is maintenance mode; Workers reached
static-asset feature parity in 2026), and Workers now supports the one
mechanism our design depends on: deterministic, stable per-PR preview
aliases via wrangler versions upload --preview-alias pr-N
(Wrangler ≥ 4.21.0), yielding:

https://pr-{N}-{worker-name}.{account-subdomain}.workers.dev

Since no repo has cut over yet, we target Workers directly rather than
migrating the fleet through Pages. preview-cloudflare (Pages, v0.11.1)
stays as released fallback.

Proposed change

Either a platform: input on preview-cloudflare (pages | workers,
default workers) or a sibling preview-workers action — maintainer's
choice; the shared change-detection and comment machinery is identical
either way (aligns with PLAN item 6, shared comment-script extraction).

Deploy-step differences from the Pages path:

• wrangler pages deploy $BUILD_DIR --project-name=X --branch=pr-N
  → wrangler versions upload --preview-alias pr-N
  (assets dir + worker name come from a minimal wrangler.toml/.jsonc
  with [assets] directory and preview_urls = true, generated by the
  action or committed per repo — decide below)
• versions upload never touches production traffic — no accidental
  "deploy" concept for preview-only workers
• Alias URL is CONSTRUCTED, not parsed (same #131 discipline). New
  required input: account-subdomain (workers.dev subdomain). The
  official wrangler-action doesn't expose the aliased URL in outputs, so
  construction remains the right call.
• Alias-safety: reuse the existing lowercase/dash mapping; pr-N already
  conforms

Design decisions

• platform: input vs sibling action
• wrangler config: generated ephemerally by the action (keeps consumer
  repos config-free, like today) vs committed per repo
• Pin wrangler ≥ 4.21.0 (also update the pinned CLI baked into the
  quantecon-preview image / GPU AMI per PROJECT-OPTIMIZE-PREVIEWS —
  wrangler, not netlify-cli)
• Outputs: keep deploy-url (stable alias) + deployment-url
  (per-version hash URL) semantics identical to the Pages action

Verify during pilot (lecture-dp)

• Static asset file-count and 25 MiB limits per Worker version
  against the largest repos' _build/html (unclear whether Workers
  got the 100k paid bump Pages received Jan 2026)
• Version retention: how long old versions + aliased URLs persist;
  pruning mechanism (differs from Pages deployments)
• Alias stability across many pushes to one PR; behaviour when two
  uploads race (concurrency-cancellation from #92 Phase 1 should land
  first)
• Fork/dependabot trust gate carries over unchanged
• Optional: Cloudflare Access in front of preview URLs (works on
  workers.dev previews) for any repo needing gated drafts

Out of scope

• Production publishing (stays on GH Pages)
• preview-netlify removal (tracked in QuantEcon/infrastructure#4 decommission)

Refs

• QuantEcon/infrastructure#4 (org migration project) · #92 (preview optimization) ·
  #105 (pipefail in wrangler output capture — fix before rollout) ·
  #131 (constructed alias URL) · PLAN items 5/6

Start with the existing preview-cloudflare Pages action and the referenced #92, #105, #131, and PLAN items 5/6; compare its change-detection, comment, alias, and trust-gate behavior with the proposed Workers path. Done means the platform, API, and configuration decisions are resolved, Workers preview aliases and outputs work for the lecture-dp pilot, and the listed limits, retention, race, and trust-gate checks are verified.