fix(site-publish): preflight all immutable routes

Authored-By: OpenAI (GPT-5) <noreply@openai.com>

tests/test_contract.py

@@ -395,6 +395,7 @@ class PublishingTests(unittest.TestCase):
             }, clear=False), patch.object(deploy, "run", side_effect=capture), \
                     patch.object(deploy, "publish_immutable_rule", side_effect=publish_immutable) as immutable_publish, \
                     redirect_stdout(output):
+                deploy.publish_route_immutables(artifact, route, root)
                 deploy.s3_sync(artifact, route, root)
 
             self.assertTrue(all(secret not in " ".join(command) for command, _ in commands))
@@ -417,28 +418,22 @@ class PublishingTests(unittest.TestCase):
                 immutable_publish.call_args.args[2]["cache_control"],
             )
 
-    def test_immutable_failure_stops_before_mutable_publication(self):
+    def test_later_route_immutable_failure_stops_all_mutable_publication(self):
         cfg = normalize_site_config(fixture("split-site.yaml"), "baseline.fritzlab.net")
-        artifact = next(item for item in cfg["artifacts"] if item["name"] == "distributions")
-        route = next(item for item in cfg["routes"] if item["artifact"] == "distributions")
         with tempfile.TemporaryDirectory() as tmp:
             root = Path(tmp)
-            html = root / artifact["build_dir"]
-            (html / "releases").mkdir(parents=True)
-            (html / "channels").mkdir()
-            (html / "releases" / "1.0.js").write_text("release")
-            (html / "channels" / "stable.json").write_text("channel")
-
-            with patch.dict(os.environ, {
-                "DIST_S3_ACCESS_KEY": "dist-key", "DIST_S3_SECRET_KEY": "dist-secret"
-            }, clear=False), patch.object(
-                deploy, "publish_immutable_rule", side_effect=RuntimeError("immutable failed")
-            ), patch.object(deploy, "run") as mutable_run, self.assertRaisesRegex(
+            with patch.object(deploy, "validate_publication_environment"), \
+                    patch.object(deploy, "validate_artifact_output"), patch.object(
+                        deploy, "publish_route_immutables",
+                        side_effect=[None, RuntimeError("immutable failed")],
+                    ) as immutable_publish, patch.object(deploy, "s3_sync") as mutable_sync, \
+                    self.assertRaisesRegex(
                 RuntimeError, "immutable failed"
             ):
-                deploy.s3_sync(artifact, route, root)
+                deploy.deploy_static("baseline", root, root, "token", cfg)
 
-            mutable_run.assert_not_called()
+            self.assertEqual(2, immutable_publish.call_count)
+            mutable_sync.assert_not_called()
 
 
     def test_absent_artifact_is_detected_before_publish(self):