fix(site-publish): retain immutable history across deploys

Authored-By: @architect <architect@fritzlab.net>

README.md

@@ -133,14 +133,12 @@ any route's mutable objects change.
 Mutable default and override partitions receive their final cache policy before
 the matching prefix-scoped stale deletion, so publication never exposes a
 provisional cache policy or a pointer to a missing immutable target.
-Generated Ingress annotations retain each bucket's prior route and immutable paths. When a move
-places that retired prefix inside the new sync scope, only its declared
-immutable subtrees are excluded; a current-file collision fails publication.
-The bucket-keyed history rejects a protected-to-public transition even when the
-artifact is renamed; publishing that artifact publicly requires a new bucket.
-Legacy single-surface is public for this downgrade check. Removing or renaming
-an immutable rule preserves its prior URLs; current mutable content at one of
-those paths is rejected instead of replacing it.
+An append-only `site-publish-history.json` beside each generated site retains every bucket's access
+class and absolute immutable prefixes, including removed routes and rules. When a route move places
+a retired prefix inside the new sync scope, that subtree is excluded; a current-file collision
+fails publication. Protected access remains sticky across artifact renames and legacy mode, so
+publishing the same artifact publicly requires a new bucket. Decommissioning removes the live
+application and manifests while retaining this history because its Garage bucket is not purged.
 
 Artifact input directories must be pairwise disjoint after filesystem
 resolution. Publication stops before build or upload if one contains another or