fix(brand): stop claiming a domain the project does not own

[Rwanbt]

Issue for this PR

Closes #31

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The owner decided G9 on 2026-08-11: no domain is acquired, the project ships no
website, and its canonical location is github.com/Rwanbt/unifia.

The problem was not that packages/web quotes opencode.ai. It is that the
rebrand invented unifia.ai — a domain nobody has registered — and put it in
places that execute. Anyone can register it, so each of these is a handle on
our users rather than a cosmetic typo.

What changes, and why each works:

• infra/stage.ts now refuses to build a domain unless
  UNIFIA_ALLOW_UPSTREAM_DEPLOY is set, the same guard script/publish.ts
  already uses for the same reason. The production domain reverts to upstream's
  real one, so no Unifia domain is fabricated in source at all.
• deploy.yml was triggered by push: [dev, production]. Since PR feat: complete the Unifia rebrand and repair the desync it left behind #23 merges
  into dev, that merge would have run sst deploy against Cloudflare
  hostnames, a Stripe webhook and PlanetScale branches we do not own. It is now
  workflow_dispatch with an explicit confirmation input, and only that path
  sets the env var above. This was the concrete hazard, not a hypothetical one.
• The Code of Conduct and the incident-response doc pointed reporters at
  conduct@ and security@unifia.ai. Those mailboxes cannot exist. They now
  use GitHub private reporting, so a report reaches someone.
• Both desktop menus opened https://unifia.ai/docs; they now open the repo.
• 17 locales displayed unifia.ai/zen on a link whose href was
  opencode.ai/zen. The label now states the real destination.
• entry.tsx branched on hostname unifia.ai. That branch could never be
  taken, since the fork serves from no domain, so it is deleted.
• Synthetic git identities move to .invalid (RFC 2606), which cannot resolve.

packages/web and packages/console are deliberately untouched. They are the
website surfaces, the fork does not publish them, and their deploy is disabled
above. Rewriting ~3100 strings there buys nothing while no site exists. The
mentions that remain elsewhere are descriptive — audit reports and explicit
prohibitions — and send nobody to the domain.

One pattern is worth carrying forward: the rebrand renamed link text without
renaming the link. The same shape is still visible in the console download
page, which copies opencode.ai/install under a label reading
unifia.ai/install. Check both directions when renaming.

How did you verify your code works?

• bun turbo typecheck --force: 35/35 successful.
• node scripts/identity/check.mjs: 7 surfaces agree with config/identity.json.
• node scripts/brand/check.mjs: 30/30 masters and 208/208 generated verified.
• packages/app: 686 pass, 0 fail, 28223 expectations across 87 files.
• Parsed both edited workflows; deploy.yml now exposes only
  workflow_dispatch, which is the property that actually removes the risk.
• bunx biome check clean on the edited sources. Four of the touched files
  fail prettier --check, but they already did so before this branch — I
  verified that against the pristine tree rather than assuming it.

Screenshots / recordings

Not a visual change: the user-visible effect is that two menu entries and one
provider link now resolve instead of dead-ending.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.