Preserve no-JavaScript contact links in the public preview

Author: rodrix2000

DEPLOYMENT.md

@@ -46,7 +46,9 @@ submission drafts, internal notes, install endpoints, templates and the upstream
 Preview-only transformations remove Omarchy's production Plausible script,
 add noindex meta/response headers, and set the homepage Open Graph URL to the
 preview domain. CSS/JavaScript entry URLs gain content-hash query versions;
-`Cache-Control: no-cache` requests revalidation of the remaining preview assets.
+`Cache-Control: no-cache, no-transform` requests revalidation of the remaining
+preview assets and prevents Cloudflare's email-obfuscation rewrite from making
+the existing public contact link depend on JavaScript.
 This prevents old cached styles from being paired with new release markup.
 Source HTML retains upstream analytics/canonical metadata for
 review; do not upload the entire source tree to a different host.

IMPLEMENTATION-NOTES.md

@@ -68,6 +68,9 @@ The public release's browser check exposed a stale stylesheet in an existing
 Chrome session. Preview packaging now fingerprints CSS/JavaScript entry URLs
 and requests cache revalidation. The source tree keeps its original filenames
 and static architecture; no bundler or runtime cache workaround was added.
+The raw-HTML audit also caught Cloudflare's automatic email obfuscation. A
+preview-only `no-transform` response directive preserves the original public
+mailto link without requiring Cloudflare's decoding script.
 
 ## Intentional deviations and limits
 

bin/prepare-preview

@@ -60,7 +60,7 @@ end
 
 File.write(File.join(output, "_headers"), <<~HEADERS)
   /*
-    Cache-Control: no-cache
+    Cache-Control: no-cache, no-transform
     X-Robots-Tag: noindex, nofollow
     X-Content-Type-Options: nosniff
     Referrer-Policy: strict-origin-when-cross-origin