Rebuilding on publish with webhooks

A static site is stale by definition between builds. The fix is a webhook: the CMS calls CI on publish, CI rebuilds, the CDN gets new HTML.

Keep the trigger dumb

The webhook should say "something changed", not "rebuild page 47". Partial rebuilds are an optimisation, and they are wrong more often than they are fast.

Where the credential lives

The token that lets the CMS start a build belongs in the CMS's webhook config, scoped to one repository. It does not belong in the repository it triggers.