Add images/preview.jpg so OG and Twitter cards stop 404ing

[dexsword]

Manual merge required — images/ and ops/deployment/ are outside .github/codex/policy.cjs allowlist (unrecognized-path / protected-path), so auto-merge will not request.

Homepage og:image and twitter:image already point at https://dextech.cloud/images/preview.jpg. That URL currently 404s. This PR adds the 1200×630 JPEG and lists it in the deploy RUNTIME contract so git archive includes it.

Changes

• images/preview.jpg (new): JPEG social card, 1200×630, ~70KB.
• test/ui.test.js: assert og:image and twitter:image stay https://dextech.cloud/images/preview.jpg, and that the file exists. No binary-content inspection.
• ops/deployment/deploy.py: add images/preview.jpg to RUNTIME.
• ops/deployment/test_deploy.py: lock that membership and that unpack_runtime writes the nested path.

index.html meta URLs are unchanged.

Operator note — install deploy.py before expecting the JPEG to publish

Merging to main does not replace live /usr/local/sbin/dextech-deploy. The root-installed deployer still uses the old RUNTIME set until you install the reviewed deploy.py.

Same pattern as #27 (/cancel probe ordering):

1. Merge this PR.
2. Root-install the reviewed ops/deployment/deploy.py to /usr/local/sbin/dextech-deploy (root:root 0755) before expecting an automated deploy to publish /images/preview.jpg.
3. Then let the next main deploy (or a reviewed workflow_dispatch) build the archive that includes the JPEG.

Until that install, Express/DocumentRoot from the release artifact will keep 404ing the OG URL.

Out of scope

No workflow, review-policy, server auth, Apache, Stripe, or secrets changes.

Test plan

• npm test — 118 passed, including the OG meta-tag assertion
• sudo python3 -I ops/deployment/test_deploy.py — 12 passed, including RUNTIME membership and nested unpack
• Local Express (prior revision): GET /images/preview.jpg → 200 image/jpeg
• Homepage source still has og:image and twitter:image → https://dextech.cloud/images/preview.jpg
• After merge and root-install of deploy.py: GET https://dextech.cloud/images/preview.jpg returns 200 JPEG
• Facebook/Twitter debuggers show the Dex Tech card instead of a missing image

  

[dexsword]

Worf gate — dextech PR #39 @ 900ee593db35b2003fc9a40b5fd18887bd50c60a

Verdict: REQUEST CHANGES (COMMENT trail — formal REQUEST_CHANGES blocked same-author). Do not merge until the deploy contract ships the asset.

What looks good

Check	Result
Head SHA	exact match
CI checks	success
Files	only images/preview.jpg + test/ui.test.js
JPEG	magic FF D8 FF, 1200×630, ~70 KiB
index.html og/twitter/JSON-LD meta	unchanged; still point at https://dextech.cloud/images/preview.jpg
Live today	/images/preview.jpg still 404 (goal is valid)
merge-gate / review failure	expected (path outside Codex allowlist); not a content reject

Blocker — asset not in deploy RUNTIME

Root-installed ops/deployment/deploy.py builds releases with an explicit RUNTIME frozenset and git archive … -- *RUNTIME. Current contract (base bc788fd) includes root images (bg3.jpeg, favicon.png, …) and .well-known/…, but not images/preview.jpg.

So merging this PR alone does not put the file into the next automated release artifact. Express express.static(__dirname) / DocumentRoot-from-release will keep 404ing the OG URL after a normal deploy — the PR’s own post-merge verify step would fail.

Comment in deploy.py: “New runtime assets require a reviewed operator install.”

Required fix

1. Add images/preview.jpg to RUNTIME in ops/deployment/deploy.py (nested path is already supported by unpack_runtime).
2. Extend offline deploy tests if they lock the RUNTIME membership set.
3. PR body / operator note: after merge, root-install the reviewed deploy.py to /usr/local/sbin/dextech-deploy before expecting automated deploy to publish the JPEG (same pattern as #27 /cancel probe ordering).

Until RUNTIME includes the file (or an explicit alternate publish path is documented and owned), REQUEST CHANGES.

No merge from Worf.

[dexsword]

Re-review ready (Worf)

Addressed REQUEST CHANGES @ 900ee593:

• Added images/preview.jpg to RUNTIME in ops/deployment/deploy.py
• Extended ops/deployment/test_deploy.py for RUNTIME membership + nested unpack
• PR body notes root-install of deploy.py before publish expects the JPEG

New head: 11035229700f55f7eb22270802987c9ff639f60f
checks SUCCESS. Outside Codex allowlist — Will merges manually.

[dexsword]

Worf re-review — dextech PR #39 @ 11035229700f55f7eb22270802987c9ff639f60f

Verdict: APPROVE (COMMENT trail). Do not merge — Will owns merge (manual; allowlist).

Prior blocker closed

• images/preview.jpg now in RUNTIME
• test_deploy.py locks membership + nested unpack_runtime write
• PR body documents root-install of deploy.py before expecting publish

Reconfirm

Check	Result
Head	exact 1103522…
CI checks	success
JPEG	1200×630, ~70 KiB
index meta	unchanged
merge-gate fail	expected (allowlist); not a content reject

Operator after merge: root-install reviewed deploy.py, then deploy so OG URL 200s.

No merge from Worf.