fix: give the Gitea workflow the intake route check the local script has

scripts/deploy-local.sh's header requires the two deploy paths to match on
everything that determines what gets published, and the route check that
replaced the stale INTAKE_ENDPOINT guard had only been added to one of them.

The check POSTs to /api/intake with no Origin header. 404 means the CloudFront
/api/* behaviour is missing; 403 means routed and refused by the handler's own
Origin check, which is a pass — and is why the probe is safe against
production, since it is rejected before any DynamoDB write or any email. It
warns rather than failing, because by that point the site is already deployed.

docs/06 now records it on the cutover item it protects, so that item no longer
rests on someone reading the list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5

docs/06-deployment.md

@@ -447,6 +447,17 @@ Then invalidate `/*`.
          (`docs/05`). Not expressible in handler code, and it is carrying load
          the unimplementable 3-second timing check was specified to carry — see
          `docs/05` §Three deviations.
+
+      ✅ **BOTH DEPLOY PATHS NOW WARN IF ITEM 1 IS MISSING**, so this does not
+      rest on someone reading this list. `scripts/deploy-local.sh` and
+      `.gitea/workflows/deploy.yml` each end with an **Intake route check**: a
+      `POST` to `/api/intake` with no `Origin`. **404 means not routed. 403 means
+      routed and refused**, which is the handler's `Origin` check doing its job
+      and is therefore a pass — and is why the probe is safe against production:
+      it is rejected before any DynamoDB write or any email. It warns rather than
+      failing, because by that point the site is already deployed and failing the
+      job would not un-deploy it. This replaced an `INTAKE_ENDPOINT` guard that
+      blocked deploys on a variable nothing read.
 - [ ] **DYNAMODB TTL ENABLED ON THE TABLE, AND VERIFIED BY A TEST RECORD. THIS
       ONE BACKS A PUBLISHED PROMISE AND MUST NOT BE TICKED FROM THE HANDLER
       CODE.** `/legal/privacy/` states that a record is *"deleted automatically