Scope Cloudflare state by site identity

[chubes4]

Summary

• resolve a validated site context from the exact request hostname before cache, coordinator, or runtime access
• partition Durable Object and D1 coordination plus R2 state, publications, jobs, artifacts, uploads, mutable wp-content, and runtime caches by site ID
• derive non-default operator and admin credentials per site while preserving the existing production hostname and sites/default/... contract
• prove concurrent two-site mutation, restart, credential, publication, and serving isolation on both coordinator backends

Closes #1972
Parent: #1970

Verification

• npm run test:cloudflare-runtime
• npm run test:cloudflare-wordpress-auth
• npm run cloudflare:dry-run
• npm run cloudflare:dry-run:d1
• npm run cloudflare:local-gate
• npm run cloudflare:local-gate:d1

Both local gates passed their complete production-shaped workflows and final concurrent Alpha/Beta isolation phase. No production deployment was performed.

AI Assistance

OpenAI gpt-5.6-sol via OpenCode implemented the site-context propagation, isolation tests, documentation, and verification workflow under Chris Huber's direction and review. Chris remains responsible for every line.