Use repo web build and agenix in deploy

.forgejo/workflows/ci-gates.yml

@@ -108,4 +108,4 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          nix develop --accept-flake-config -c bash -c 'cd apps/web && env -u NO_COLOR trunk build --release --public-url /'
+          bash ./scripts/build-web.sh

.forgejo/workflows/deploy-cloudflare.yml

@@ -83,7 +83,7 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          nix develop --accept-flake-config -c bash -c 'cd apps/web && env -u NO_COLOR trunk build --release --public-url /'
+          bash ./scripts/build-web.sh
 
   deploy:
     if: ${{ github.server_url != 'https://codeberg.org' }}
@@ -136,7 +136,7 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          nix develop --accept-flake-config -c age --version
+          nix develop --accept-flake-config -c bash -c 'command -v agenix >/dev/null'
           nix develop --accept-flake-config -c node --version
           nix develop --accept-flake-config -c npm --version
           nix develop --accept-flake-config -c wrangler --version
@@ -191,7 +191,7 @@ jobs:
             echo "error: missing ${secret_file}"
             exit 2
           fi
-          CLOUDFLARE_API_TOKEN="$(nix develop --accept-flake-config -c age -d -i "$key_file" "$secret_file")"
+          CLOUDFLARE_API_TOKEN="$(nix develop --accept-flake-config -c agenix -d "$secret_file" -i "$key_file")"
           if [[ -z "${CLOUDFLARE_API_TOKEN}" ]]; then
             echo "error: decrypted CLOUDFLARE_API_TOKEN is empty"
             exit 2
@@ -211,7 +211,7 @@ jobs:
         run: |
           set -euo pipefail
           cd .repo
-          nix develop --accept-flake-config -c bash -c 'cd apps/web && env -u NO_COLOR trunk build --release --public-url /'
+          bash ./scripts/build-web.sh
 
           curl -fsSL -X POST -H "Authorization: token ${GITHUB_TOKEN}" \
             -H "content-type: application/json" \

evolution/proposals/ECP-0123-instant-station-guide-and-player-warmup.md

@@ -59,3 +59,5 @@ prevents dynamic-linker failures from blocking the Cloudflare asset rollout.
 
 The workflow ECP gate starts at ECP-0120 because older proposals predate the current lint shape.
 The lint script uses ripgrep when available and falls back to GNU grep on the Forgejo runner.
+Cloudflare deployment decrypts the API token through the repo's agenix workflow and builds web
+assets through `scripts/build-web.sh` so local and runner build paths stay aligned.