cmc Closes #15. . serves the pages branch of public repos (repo 'pages' at root, others under //); separate origin, no forge CSP; on-demand ACME per subdomain; config-gated.