ci(web): run wrangler via pnpm dlx so env vars expand

cloudflare/wrangler-action v3 passes its 'command' input to wrangler
without shell expansion, so $DEPLOY_BRANCH ended up being the literal
branch name on every deploy. All deploys landed in a preview slot called
'$DEPLOY_BRANCH' instead of 'develop', leaving wheels-*.pages.dev
production URLs empty and blog/guides/api subdomains returning 404.

Swap to a plain 'run:' step that invokes wrangler via pnpm dlx, with
env vars routed through the shell properly. Same security posture for
untrusted branch names (quoted env expansion, not command interpolation).

Author: bpamiri

.github/workflows/web-deploy.yml

@@ -53,11 +53,15 @@ jobs:
         run: pnpm --filter @wheels-dev/site-${{ matrix.site }} build
 
       - name: Deploy to Cloudflare Pages
-        uses: cloudflare/wrangler-action@v3
+        working-directory: web
         env:
-          # Untrusted inputs — pass via env to prevent command injection
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+          # Routed via env to keep untrusted branch names out of the command string.
           DEPLOY_BRANCH: ${{ github.head_ref || github.ref_name }}
-        with:
-          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          command: pages deploy web/sites/${{ matrix.site }}/dist --project-name=wheels-${{ matrix.site }} --branch="$DEPLOY_BRANCH" --commit-hash="$GITHUB_SHA"
+          SITE: ${{ matrix.site }}
+        run: |
+          pnpm dlx wrangler@4.78.0 pages deploy "sites/${SITE}/dist" \
+            --project-name="wheels-${SITE}" \
+            --branch="${DEPLOY_BRANCH}" \
+            --commit-hash="${GITHUB_SHA}"