[appdevelopsk]

Critical deployment truth

The public apex appdevelopsk.com is served by nginx on a VPS, not by this repository's main branch or the GitHub Pages pages-blank branch. PR #4 merged and CI passed, but source merge alone cannot make the 92-app finder or guides live. Earlier public-policy outages show why production parity must be verified.

Changes

• scripts/publish_app_discovery.sh: dry-run by default; optional --apply explicitly copies only four release artifacts (apps.html, sitemap.xml, and two guide index pages) with rsync --relative and no --delete. Restricted host/root arguments; never touches privacy/support/legal/payment files.
• scripts/check_app_discovery_live.sh: read-only checks HTTP 200 and actual body markers for /apps, both SEO guide canonicals, click event markers and sitemap. No success claimed without this check.
• Document exact VPS operator steps, rollout gates, Google Search Console follow-up and measurable GA4 -> store -> first app value -> D1/D7 acquisition funnel, distinguishing 92 publicly listed apps from 117 built.
• CI validates shell syntax and existing catalog static regression tests.
• Update /apps sitemap lastmod to actual date of content changes, leaving old pages unchanged.

This PR must not auto-deploy production or count installs. It gives the user a reproducible release command and a truthful live verification gate.