fix(docs): make the canonical-host redirect actually run

[rubenvdlinde]

The redirect from #635 never fired

The asset server answers before the Worker script. When a request path matches a file in ./build, Cloudflare serves it directly and the script is never invoked — so the redirect could only run for paths with no asset, which is never the case for a real documentation page.

Why the green run was not evidence

Measured on the buildiq pilot. Every signal that normally counts said it worked:

• the generated wrangler.toml carried main = "./docs-redirect-worker.js" and binding = "ASSETS"
• wrangler printed env.ASSETS Assets, Uploaded openbuild-docs, Deployed openbuild-docs triggers
• the workflow run was green

and openbuild.conduction.nl/docs/intro/ still answered 200, not 301.

What settled it was testing the worker's own workers.dev URL:

openbuild-docs.conduction-a2d.workers.dev/docs/intro/  ->  200

That hostname is not the canonical one either, so a running script would have redirected it too. The route was correct and the script was deployed — it simply never executed.

The fix

run_worker_first = true in [assets] puts the script ahead of the asset server. It is emitted only alongside canonical-host, so a site that has not opted in still gets byte-for-byte the config it had.

Verification

The generator was executed both ways again:

	without canonical-host	with it
output	unchanged from before #635	gains main, binding, run_worker_first

Next: redeploy buildiq and confirm openbuild.conduction.nl 301s to buildiq.conduction.nl with the path preserved, before the remaining 20 apps go anywhere near this.