[callumalpass]

Summary

• Opt in to hidden files in actions/upload-pages-artifact v5, which otherwise excludes the .well-known directory.
• Verify the built challenge matches the public source before uploading, and retain a regression test in the existing documentation suite.

Evidence

• PR 98 merged and its deployment succeeded, but the public challenge returned 404.
• Downloaded the actual deployed github-pages artifact: it contains no .well-known challenge.
• The official v5 action declares include-hidden-files=false by default and excludes dot paths from its tar archive.
• public/.well-known/openai-apps-challenge is the only tracked hidden public asset.

Validation

• Remote test:docs: 5 passed on Node 24.11.1.
• No new CI jobs, gateway changes, or unrelated site changes.