Wait for complete Cloudflare asset propagation during verification

[deku2026]

Change

The first custom-domain deployment exposed a propagation race: __build.json identified the new candidate while one public response still lacked its new cache policy. Without another deployment, all file headers and all twelve live browser tests then passed.

After identity readiness, retry the complete read-only asset/hash/header/404 probe under a shared two-minute abort deadline. Keep exact validation and mandatory browser checks, include the last failing path/header in diagnostics, and never automatically redeploy or retry browser assertions.

Validation

• npm run check (10 tests, including delayed response headers and permanent mismatch failure)
• Existing production artifact: all twelve Chromium/Firefox/WebKit tests passed against https://arcforges.com
• Real custom-domain HTML no longer contains the injected analytics beacon
• PR CI will independently rebuild and validate the candidate

Deployment

No new credentials or account changes. This is a targeted correction to run 35032047709; its failed release gate was preserved. A subsequent main run must still pass complete live verification before creating a release.