ci(deploy): tolerate 403 on post-deploy health check (#11)

The peptide-starter-theme v1.5.2 release added
peptide_starter_is_cloudflare_peer() — a CF-peer IP validator that
correctly rejects direct-to-origin requests as non-Cloudflare traffic
with HTTP 403. The deploy workflow's post-deploy health check makes
exactly such a request from a GHA runner IP, so it now reliably
receives 403 even on successful deploys.

Two deploys today (peptide-starter-theme v1.5.2, prautoblogger Commit 1a)
both succeeded but reported workflow failure due to this. The actual
deploys (rsync + cache purge) ran clean; site verified HTTP 200 from
real traffic both times.

Fix: accept either 200 (normal healthy response) or 403 (validator
actively rejecting non-CF origin — itself a positive liveness signal)
in the health check. Reject only on 5xx, 4xx-other, or connection
failure.

Reverting this fix is correct only if we either (a) bypass the
validator for our own health-check user-agent, or (b) route the
health check through Cloudflare. Both are larger changes for a
later release.

Agent-Session: cowork-deploy-healthcheck-fix-20260415

Co-authored-by: peptiderepo <peptiderepo@users.noreply.github.com>

.github/workflows/deploy.yml

@@ -91,11 +91,16 @@ jobs:
         run: |
           sleep 5
           STATUS=$(curl -s -o /dev/null -w "%{http_code}" https://peptiderepo.com)
-          if [ "$STATUS" != "200" ]; then
-            echo "WARNING: Site returned HTTP $STATUS after deploy"
+          # 200 = normal healthy response.
+          # 403 = peptide-starter-theme v1.5.2 CF-peer validator rejecting this
+          #       GHA-runner direct-to-origin request as non-Cloudflare traffic.
+          #       That rejection is the validator working — itself a positive
+          #       liveness signal. Real user traffic via Cloudflare gets 200.
+          if [ "$STATUS" != "200" ] && [ "$STATUS" != "403" ]; then
+            echo "ERROR: Site returned unexpected HTTP $STATUS after deploy"
             exit 1
           fi
-          echo "Site is healthy (HTTP 200)"
+          echo "Site is responsive (HTTP $STATUS)"
 
       - name: Cleanup
         if: always()