upgrade: adopt V8.21.3 (V8.13→8.21.3: P5 SFTP/S3, P6 multilingual, editor overhaul, enterprise hardening)

Overlay ~150 upstream items onto our V8.12 base, preserving trade-pro
theme, registry tests, and design docs. Re-applied our patch set
(discovery/env_for/blocks.css/type-mapping/theme_color/frontend entries,
test_theme_pro_v3 mods) — all anchors survived upstream evolution.

New platform enhancement (fixes upgrade-introduced regression):
multilingual.site_locale now honors settings_json.locale, plus
PUT /api/i18n/sites/{id}/locale — standalone English sites get
<html lang='en'> under the V8.15 locale-rewrite pipeline.

compose: adopt V8.21.3 (image 8.21.3-dev.1, /api/ready probes, MySQL/S3
env) with project name pinned to siteforge-v8-10 (data volumes).

Tests: 356 passed / 11 failed — all 11 confirmed pre-existing in
pristine V8.21.3 on this host (10 upstream Windows env + our build test
now green after locale fix). Patch registry updated in plan doc.

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/worker.py

@@ -6,7 +6,7 @@ import subprocess
 import sys
 import time
 import uuid
-from . import db, enterprise, builder, jobs
+from . import db, enterprise, builder, jobs, worker_health
 
 running=True
 WORKER_ID=uuid.uuid4().hex[:12]
@@ -17,7 +17,7 @@ def heartbeat():
     This single-worker probe is deliberately not used as a multi-worker
     membership system; multi-worker orchestration needs separate leases.
     """
-    path=db.DATA/'worker-heartbeat'
+    path=worker_health.heartbeat_path()
     path.parent.mkdir(parents=True,exist_ok=True)
     temp=path.with_suffix(f'.{WORKER_ID}.tmp')
     temp.write_text(WORKER_ID,encoding='ascii')
@@ -49,11 +49,17 @@ def complete(job, value=None, error=None, retryable=False, cancelled=False, time
         current=c.execute('SELECT * FROM build_jobs WHERE id=?',(job['id'],)).fetchone()
         if not current or current['state']!='running' or current['worker_id']!=WORKER_ID:
             return
+        # A networked release may already have changed the remote pointer.
+        # Cancellation/timeout/crash is UNKNOWN remote outcome, not safe retry.
+        external=current['kind'] in ('remote_deploy','remote_rollback')
         if cancelled or current['cancel_requested']:
-            state='cancelled'
+            if external:
+                state='failed'
+                error='Release interrupted; reconcile target before manual retry'
+            else:state='cancelled'
         elif error is None:
             state='done'
-        elif retryable and current['attempts']<current['max_attempts']:
+        elif retryable and not external and current['attempts']<current['max_attempts']:
             state='retrying'
         else:state='failed'
         delay=min(60,2**current['attempts']) if state=='retrying' else 0