docs-gates: smoke per-probe retry + explicit UA; workers: broaden asset-ext classificationclaude/smoke-hardening

smoke.py — BIC independence: probe requests now send an explicit User-Agent
(vyos-docs-smoke/1.0) so the gate no longer depends on a Cloudflare Browser
Integrity Check UA-skip rule surviving. The default Python-urllib UA was blocked
by BIC until that exemption was added; a silent dependency on it is a latent gate
failure the moment the rule is touched.

smoke.py — propagation-race tolerance: each probe now retries up to 3 attempts
(20s apart; MAX_ATTEMPTS + RETRY_SLEEP_SECONDS are module-level so tests can shrink
them) and only fails after the final attempt. A freshly deployed worker version
loses a brief propagation race in which a single probe is served by the PREVIOUS
version (observed: status 307 + stale X-Docs-Build minutes after deploy), which
previously failed the entire gate. Intermediate attempts log SMOKE-RETRY; only
exhaustion logs SMOKE-FAIL and counts a failure. Retry fires only on a not-ok
outcome (wrong status, wrong/missing build header, missing search mount, or a
transport exception); a legitimately-expected 404 passes on the first attempt.

workers/branch — broaden asset classification (CodeRabbit post-merge nit): fold
.pdf into the case-insensitive ASSET_EXT_RE and add webp + otf, so uppercase .PDF
and modern image/font assets get the longer asset cache class. /_static/ and
/_images/ path checks unchanged.

🤖 Generated by [robots](https://vyos.io)

2 files changed, 6 insertions, 4 deletions

diff --git a/workers/branch/src/index.ts b/workers/branch/src/index.ts
index 7cdaaf14..47ef3ad6 100644
--- a/workers/branch/src/index.ts
+++ b/workers/branch/src/index.ts
@@ -6,13 +6,12 @@ export interface Env {
 
 export type CacheClass = "page" | "asset";
 
-// Binary/media assets get the longer asset cache class, alongside .pdf and the Sphinx
-// /_static/ (theme) + /_images/ (figure) trees.
-const ASSET_EXT_RE = /\.(png|jpe?g|svg|gif|ico|woff2?|ttf|eot)$/i;
+// Binary/media asset extensions (case-insensitive, so ".PDF" also matches) get the longer
+// asset cache class, alongside the Sphinx /_static/ (theme) + /_images/ (figure) trees.
+const ASSET_EXT_RE = /\.(pdf|png|jpe?g|webp|svg|gif|ico|woff2?|ttf|otf|eot)$/i;
 
 export function classifyPath(path: string): CacheClass {
   if (
-    path.endsWith(".pdf") ||
     path.includes("/_static/") ||
     path.includes("/_images/") ||
     ASSET_EXT_RE.test(path)
diff --git a/workers/branch/test/content.test.ts b/workers/branch/test/content.test.ts
index 94a0d5a6..6d04c35b 100644
--- a/workers/branch/test/content.test.ts
+++ b/workers/branch/test/content.test.ts
@@ -243,8 +243,11 @@ describe("asset cache-class classification (§3.3, extended)", () => {
       "/en/rolling/_static/fonts/roboto.woff2",
       "/en/rolling/logo.svg",
       "/en/rolling/photo.jpeg",
+      "/en/rolling/hero.webp",               // webp added to ASSET_EXT_RE (standalone path)
+      "/en/rolling/font.otf",                // otf added to ASSET_EXT_RE (standalone path)
       "/en/rolling/icon.ico",
       "/en/rolling/vyos-documentation.pdf",
+      "/en/rolling/vyos-documentation.PDF",  // .pdf folded into the case-insensitive regex
     ]) {
       expect(classifyPath(p)).toBe("asset");
     }