fix(site-publish): close split migration boundaries

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

scripts/deploy.py

@@ -204,12 +204,18 @@ def s3_sync(artifact, route, site_dir, credential_env_names=None):
     # so a fresh upload always carries the right MIME type.
     specific_paths = [rule["path"] for rule in artifact["cache_rules"] if rule["path"]]
     default_filters = [arg for path in specific_paths for arg in ("--exclude", f"{path}/*")]
+    # A move from a nested route to `/` makes the old partition fall inside the
+    # new sync scope. Preserve declared immutable subtrees at every retired
+    # prefix without enumerating the bucket.
+    retired_immutable_filters = [
+        arg for path in immutable_paths for arg in ("--exclude", f"*/{path}/*")
+    ]
     run(["aws", "--endpoint-url", endpoint, "s3", "cp", f"{html_dir}/", destination,
          "--recursive", "--only-show-errors", "--cache-control", default_cache,
-         *default_filters, *exclude_args], env=aws_env)
+         *default_filters, *retired_immutable_filters, *exclude_args], env=aws_env)
     run(["aws", "--endpoint-url", endpoint, "s3", "sync", f"{html_dir}/", destination,
          "--delete", "--only-show-errors", "--cache-control", default_cache,
-         *default_filters, *exclude_args], env=aws_env)
+         *default_filters, *retired_immutable_filters, *exclude_args], env=aws_env)
     for rule in artifact["cache_rules"]:
         if not rule["path"]:
             continue