Depot publish executed over the new passwordless tailnet path (allowlist auth,
GOD3_DEPOT=http://100.94.195.115:8788). Two contract bugs fixed en route:
- publish.py: /api/thumb wants JPEG keyed by the GLB name (was posting PNG keyed
by a .png name -> 404 that mislabelled successful GLB uploads as ERR); thumb
push now isolated per the MESHGOD house contract (cosmetic, never fails publish).
- validate_manifest.py: send a custom User-Agent (Cloudflare 403s Python-urllib
on the public path) + honor GOD3_DEPOT override like publish.py.
validate_manifest.py --depot -> 0 errors, 0 warnings. qa.sh --strict all green.
_published.json records the 16 published assets.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
