fix(site-publish): close split migration boundaries

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

tests/test_contract.py

@@ -230,6 +230,16 @@ class ConfigContractTests(unittest.TestCase):
             with self.assertRaisesRegex(ConfigError, "build input contains symlink"):
                 validate_artifact_inputs(root, cfg)
 
+    def test_artifact_root_symlink_is_rejected_before_resolution(self):
+        cfg = normalize_site_config(self.raw, "baseline.fritzlab.net")
+        with tempfile.TemporaryDirectory() as tmp:
+            root = Path(tmp)
+            (root / "dist-real").mkdir()
+            (root / "dist").symlink_to(root / "dist-real")
+            (root / "portal" / "build").mkdir(parents=True)
+            with self.assertRaisesRegex(ConfigError, "content_dir contains symlink component"):
+                validate_artifact_inputs(root, cfg)
+
 
 class GenerationTests(unittest.TestCase):
     def render(self, raw):
@@ -417,6 +427,7 @@ class PublishingTests(unittest.TestCase):
             rendered = [" ".join(command) for command, _ in commands]
             self.assertIn("s3://baseline-dist/dist/", rendered[0])
             self.assertIn("releases/*", rendered[0])
+            self.assertIn("*/releases/*", rendered[0])
             self.assertNotIn("--delete", rendered[0])
             self.assertIn("--delete", rendered[1])
             self.assertTrue(all("s3://baseline-dist/dist/" in command for command in rendered[1:]))