feat(deploy): production on tablo.run + preview-<N>.tablo.run subdomains

[i11v]

What

Moves tablo's production custom domain to the apex tablo.run and gives every PR preview its own preview-<N>.tablo.run hostname (previews were workers.dev-only before). Also lands the @distilled.cloud/core patch that makes custom-domain deletes (preview teardown + the production cutover itself) survive a beta CF-client bug.

Why two commits, in this order

1. fix(deploy): patch @distilled.cloud/core empty-body DELETE crash — Cloudflare answers DELETE /workers/domains/{id} with an empty 200 body; the beta CF client falls through to envelope-schema decode, fails, and aborts the whole deploy/destroy with the misleading CloudflareHttpError: null, orphaning the worker + its state. This fires on every custom-domain teardown (the PR-close cleanup job) and on any production domain switch (reconcileDomains deletes the old domain). Patched via bun patch to treat an empty/null 2xx body as no-content, mirroring the client's own 204 branch. bun install --frozen-lockfile re-applies it on every CI runner. Drop once upstream alchemy-run/distilled#344 ships in a released @distilled.cloud/core.

2. feat(deploy): serve production on tablo.run, previews on preview-<N>.tablo.run — new workerDomain() helper co-located with workerName(): production → tablo.run, pr-<N> → preview-<N>.tablo.run, everything else → none. The worker name keeps the pr- scheme (tablo-pr-<N>); only the public hostname reads preview-. Both workers.dev URLs stay live via url: true, so the health smoke test keeps hitting the deterministic workers.dev URL while the PR comment now advertises the custom domain (with workers.dev as a fallback line).

The patch lands first so the production cutover — which detaches tablo.i11v.com — and every preview teardown are both safe.

Deploy / cutover

Merging triggers the existing CI prod deploy (--stage production), which attaches tablo.run and detaches tablo.i11v.com (replace, not keep-both). The tablo.run zone already exists in the account, so Cloudflare auto-provisions the proxied DNS record + TLS cert — no per-deploy dashboard or DNS steps.

One manual prerequisite (dashboard)

tablo.run is apex and Workers Custom Domains create the apex DNS record. Before merging, confirm the tablo.run zone has no conflicting proxied A/AAAA/CNAME at the apex (a parking/placeholder record), or the first prod deploy's domain attach will fail. preview-<N>.tablo.run subdomains are covered by Universal SSL's *.tablo.run.

Verification

typecheck clean, 79/79 unit tests pass (incl. 4 new workerDomain cases), and the patch was confirmed to re-apply on a clean bun install --frozen-lockfile with alchemy resolving to the patched copy. Live domain provisioning + teardown against the Cloudflare API only run in CI — this PR's own preview deploy exercises a preview-<N>.tablo.run attach, and closing it exercises the patched teardown.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Gp4ZeUYKtUbPkhjM8Gb4TN

[github-actions]

🚀 Preview deployed: https://preview-18.tablo.run
_{fallback: https://tablo-pr-18.i11v.workers.dev}