fix(worker): use raw.githubusercontent.com as origin to avoid Pages 301 loop (#504)

Once the CNAME file is in place on gh-pages (Phase 4a-APT), GitHub
Pages auto-301s all aaddrick.github.io/claude-desktop-debian/* traffic
to pkg.claude-desktop-debian.dev/*. The Worker's origin fetch against
aaddrick.github.io gets 301'd by Pages, the 301 passes through to the
client, the client follows it back to pkg.<domain>, and the Worker
runs again — infinite loop.

Observed immediately after merging #503 and Pages finishing the CNAME
build:

  $ curl -I https://pkg.claude-desktop-debian.dev/dists/stable/InRelease
  HTTP/2 301
  location: http://pkg.claude-desktop-debian.dev/dists/stable/InRelease
  x-github-request-id: 3C94:286425:...
  x-served-by: cache-yyz4566-YYZ
  via: 1.1 varnish

(Scheme-downgrade to http is a separate Pages quirk when
 https_enforced=false, which is the case here because DNS points
 at Cloudflare, not Pages, so Pages can't provision a cert.)

raw.githubusercontent.com serves the same gh-pages branch content
without Pages' routing layer. All five metadata paths verified to
return 200:

  /dists/stable/InRelease
  /dists/stable/main/binary-amd64/Packages
  /KEY.gpg
  /rpm/x86_64/repodata/repomd.xml
  /rpm/x86_64/repodata/repomd.xml.asc

Also fixes the deploy-worker.yml post-deploy probe which still
hardcoded pkg-staging. That's what made #503's deploy show as
failed in the Actions UI even though the wrangler deploy itself
succeeded — route bound and Worker live, but the probe was
resolving a hostname wrangler had just removed.

Refs #493, #503

Co-authored-by: Claude <claude@anthropic.com>

Author: aaddrick

.github/workflows/deploy-worker.yml

@@ -27,9 +27,8 @@ jobs:
 
       - name: Verify route is bound and Worker responds
         env:
-          # Probe whichever route wrangler.toml currently binds. Update this
-          # when Phase 4a switches wrangler.toml to the production hostname.
-          PROBE_HOST: pkg-staging.claude-desktop-debian.dev
+          # Must match the hostname in worker/wrangler.toml's route.
+          PROBE_HOST: pkg.claude-desktop-debian.dev
         run: |
           # Wait briefly for deploy + DNS propagation
           sleep 30

worker/src/worker.js

@@ -10,7 +10,13 @@
 //
 // See docs/worker-apt-plan.md for the full architecture.
 
-const ORIGIN = 'https://aaddrick.github.io/claude-desktop-debian';
+// Raw gh-pages content, bypassing the Pages routing layer. Fetching
+// via aaddrick.github.io auto-301s back to pkg.<domain> once the CNAME
+// is in place (Pages' custom-domain redirect), creating a loop through
+// this Worker. raw.githubusercontent.com serves the same branch content
+// directly and is unaffected by the custom-domain config.
+const ORIGIN =
+	'https://raw.githubusercontent.com/aaddrick/claude-desktop-debian/gh-pages';
 const RELEASES =
 	'https://github.com/aaddrick/claude-desktop-debian/releases/download';