feat(site-publish): add split-surface publishing

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

action.yaml

@@ -1,15 +1,15 @@
 name: Publish Site
-description: Build and deploy a static-content site (static, hugo, mkdocs) to Garage S3 with Traefik + cert-manager. Containerized apps should use action/image-build + action/image-push + action/image-deploy.
+description: Build and deploy one or more routed static-content artifacts to Garage S3 with Traefik and cert-manager.
 inputs:
   token:
     description: Gitea token (ci-bot) for apps repo push and API operations
     required: true
   s3-access-key:
-    description: Garage ci-deploy-key access key id
-    required: true
+    description: Garage access key id (required by the legacy single-surface contract)
+    required: false
   s3-secret-key:
-    description: Garage ci-deploy-key secret access key
-    required: true
+    description: Garage secret access key (required by the legacy single-surface contract)
+    required: false
   s3-endpoint:
     # Targets garage-s3 (data-only Service) so requests do not round-robin onto
     # the gateway pod, whose emptyDir-backed metadata view intermittently
@@ -18,7 +18,7 @@ inputs:
     required: false
     default: http://garage-s3.storage.svc:3900
   garage-admin-token:
-    description: Garage admin API token (required only when site.yaml has aliases — used to reconcile bucket globalAliases)
+    description: Garage admin API token (required only for legacy aliases — used to reconcile bucket globalAliases)
     required: false
   garage-admin-endpoint:
     description: Garage admin API endpoint URL