fix: rebuild historical docs with audited tooling

Author: rockyshi1993

.github/workflows/deploy-docs.yml

@@ -53,6 +53,17 @@ jobs:
           echo "DOCS_RELEASE_VERSION=${PACKAGE_VERSION}" >> "${GITHUB_ENV}"
           echo "DOCS_RELEASE_CHANNEL=stable" >> "${GITHUB_ENV}"
 
+      - name: Select verified website toolchain
+        shell: bash
+        run: |
+          if node -e "process.exit(require('./release/website/package.json').scripts?.verify ? 0 : 1)"; then
+            echo "DOCS_LEGACY_TAG=false" >> "${GITHUB_ENV}"
+          else
+            cp tooling/website/package.json release/website/package.json
+            cp tooling/website/package-lock.json release/website/package-lock.json
+            echo "DOCS_LEGACY_TAG=true" >> "${GITHUB_ENV}"
+          fi
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
@@ -71,7 +82,7 @@ jobs:
         working-directory: ./release/website
         shell: bash
         run: |
-          if node -e "process.exit(require('./package.json').scripts?.verify ? 0 : 1)"; then
+          if [[ "${DOCS_LEGACY_TAG}" != "true" ]]; then
             npm run verify
           else
             npm run build

changelogs/v3.0.0.md

@@ -52,7 +52,7 @@ v3.0.0 consolidates the unpublished v2.0.7 work into a major release. It adds bo
 - Saga step timeouts use `OPERATION_TIMEOUT`, abort the cooperative context signal, and never trigger retries; failed runtime connection attempts await partial resource cleanup before returning.
 - Runtime dependencies are pinned to `schema-dsl@2.1.5` and `ioredis@5.11.1`; Node 18-compatible test tooling uses `mongodb-memory-server@10.4.3`.
 - Release candidates must be clean, have a valid installed dependency graph, and already exist on `origin`; the same preflight also verifies the docs site and packaged `MIGRATION.md` / `SECURITY.md` consumer guidance.
-- Stable Pages deployment separates immutable release-tag content from current release tooling, so historical stable tags can use their tag-native build plus current link and audit gates without deploying unpublished branch content; current releases still require the complete website verification chain.
+- Stable Pages deployment separates immutable release-tag content from current release tooling, so historical stable tags can rebuild their tagged docs with the current audited website toolchain and link gate without deploying unpublished branch content; current releases still require the complete website verification chain.
 
 ## Compatibility-impacting changes
 

test/smoke/release-contract.test.ts

@@ -80,6 +80,9 @@ test('stable docs deployment requires an npm-verified release tag', () => {
     assert.match(deployDocs, /path: release/);
     assert.match(deployDocs, /path: tooling/);
     assert.match(deployDocs, /ref: \$\{\{ github\.sha \}\}/);
+    assert.match(deployDocs, /Select verified website toolchain/);
+    assert.match(deployDocs, /cp tooling\/website\/package-lock\.json release\/website\/package-lock\.json/);
+    assert.match(deployDocs, /DOCS_LEGACY_TAG/);
     assert.match(deployDocs, /npm run verify/);
     assert.match(deployDocs, /check-site-links\.cjs --dist/);
     assert.match(deployDocs, /npm audit/);