docs: the landing page is the front door, the app moves to /app/

User ruling on improvise-kh8, overturning the arrangement the previous commit
shipped: "The landing page should be served at the root of the repository and
link to the in-browser demo." The argument for the other arrangement is left
standing in the ticket rather than deleted — it is overruled, not wrong to have
considered — and the root is now `docs/index.html`.

The app moves under `app/` WHOLE, both bundle directories included. Every path
in `app.js` and `worker.js` is relative, so moving the bundle together keeps
every one of them correct and the wasm-pack generated glue untouched;
`worker.js`'s `fetch("demo.improv")` resolves against the worker's own URL, so
the seed follows for the same reason. The four `stamped` guards in
`assemble.sh` follow the files: they are the only check that the cache-bust
substitution worked, and a guard aimed at a path nothing writes fails in the
direction that looks like success.

`harness/tests/shell.spec.js` navigates to `/index.html` six times, including
the `?ws=` and `?doc=` variants, and every one of those now lands on the
landing page. All six are repointed at `/app/index.html`. That file is outside
this unit's declared scope and is the second deliberate stray in this PR.

VERIFIED AGAINST THE ASSEMBLED TREE, not against `docs/` directly, because a
path move is what re-arms the trap this page already caught once. With real
bundles from `web/build.sh`:

  * `npx playwright test tests/shell.spec.js --project=chromium` — 6 passed,
    with `/app/{index.html,app.js,style.css,worker.js,demo.improv}` and both
    `?v=` stamped bundles all served 200;
  * the four casts play 37 lines each at the site root, no failed request and
    no page error;
  * the full journey: load the root, click the call to action, land on `/app/`,
    and the grid draws out of the in-page worker — 12 cells, all editable,
    a "Revenue" header, `#status` reading "in-page worker · demo.improv".

The call-to-action check was proved able to fail by pointing the link at
`./aap/`: 404, while the page still looks entirely correct.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/assemble.sh

@@ -1,5 +1,6 @@
 #!/bin/sh
-# Assemble the static site from `web/` into `site/`.
+# Assemble the static site into `site/`: the landing page from `docs/` at the
+# root, and the browser app from `web/` under `app/`.
 #
 # `web/` is the *source* directory: it also holds build.sh, assemble.sh and
 # .gitignore, which have no business being served. This copies what ships.
@@ -33,35 +34,37 @@ test -d "$root/web/worker-pkg" || { echo "web/worker-pkg missing — run web/bui
 
 rm -rf "$out"
 mkdir -p "$out"
-cp -f "$root/web/index.html" "$root/web/app.js" "$root/web/style.css" "$root/web/worker.js" "$out/"
+
+# The landing page is the front door and the app is what it sends you to
+# (user ruling, improvise-kh8). So `docs/` lands at the ROOT and the app moves
+# under `app/` whole — every path in app.js and worker.js is relative, so the
+# bundles travel with it and the generated glue needs no editing.
+cp -f "$root/docs/index.html" "$out/index.html"
+cp -rf "$root/docs/casts" "$out/casts"
+
+app="$out/app"
+mkdir -p "$app"
+cp -f "$root/web/index.html" "$root/web/app.js" "$root/web/style.css" "$root/web/worker.js" "$app/"
 # The document the page opens on a browser that has never seen one.
 # web/worker.js fetches it by the ?seed= URL and hands the bytes to Rust,
 # which writes them through the VFS — so leaving it out is an empty grid, not
 # a 404 the page could report.
-cp -f "$root/web/demo.improv" "$out/"
+cp -f "$root/web/demo.improv" "$app/"
 
-# The landing page (improvise-e61), beside the app rather than in front of it:
-# the live app is the better front door, and a page the deploy never copies is
-# a file nobody can reach. Its cast paths are relative, so `docs/` and
-# `site/landing/` serve the same file unchanged.
-mkdir -p "$out/landing"
-cp -f "$root/docs/index.html" "$out/landing/index.html"
-cp -rf "$root/docs/casts" "$out/landing/casts"
-
-cp -rf "$root/web/pkg" "$out/pkg"
-cp -rf "$root/web/worker-pkg" "$out/worker-pkg"
-rm -f "$out/pkg/.gitignore" "$out/pkg/package.json"
-rm -f "$out/worker-pkg/.gitignore" "$out/worker-pkg/package.json"
+cp -rf "$root/web/pkg" "$app/pkg"
+cp -rf "$root/web/worker-pkg" "$app/worker-pkg"
+rm -f "$app/pkg/.gitignore" "$app/pkg/package.json"
+rm -f "$app/worker-pkg/.gitignore" "$app/worker-pkg/package.json"
 
 # BSD sed (macOS) needs an argument to -i; GNU sed must not be given one.
 sedi() { sed "$1" "$2" > "$2.tmp" && mv -f "$2.tmp" "$2"; }
 
-sedi "s|\./pkg/improvise_wasm_client\.js|&?v=${token}|" "$out/app.js"
-sedi "s|\./worker-pkg/improvise_worker_server\.js|&?v=${token}|" "$out/worker.js"
+sedi "s|\./pkg/improvise_wasm_client\.js|&?v=${token}|" "$app/app.js"
+sedi "s|\./worker-pkg/improvise_worker_server\.js|&?v=${token}|" "$app/worker.js"
 sedi "s|'improvise_wasm_client_bg\.wasm'|'improvise_wasm_client_bg.wasm?v=${token}'|" \
-  "$out/pkg/improvise_wasm_client.js"
+  "$app/pkg/improvise_wasm_client.js"
 sedi "s|'improvise_worker_server_bg\.wasm'|'improvise_worker_server_bg.wasm?v=${token}'|" \
-  "$out/worker-pkg/improvise_worker_server.js"
+  "$app/worker-pkg/improvise_worker_server.js"
 
 # One `grep` over all four files succeeds when ANY one of them matches, so
 # three failed substitutions could still produce a "successful" assembly under
@@ -75,7 +78,7 @@ stamped() {
   }
   grep -n "$2" "$1"
 }
-stamped "$out/app.js" "pkg/improvise_wasm_client.js?v=${token}"
-stamped "$out/worker.js" "worker-pkg/improvise_worker_server.js?v=${token}"
-stamped "$out/pkg/improvise_wasm_client.js" "improvise_wasm_client_bg.wasm?v=${token}"
-stamped "$out/worker-pkg/improvise_worker_server.js" "improvise_worker_server_bg.wasm?v=${token}"
+stamped "$app/app.js" "pkg/improvise_wasm_client.js?v=${token}"
+stamped "$app/worker.js" "worker-pkg/improvise_worker_server.js?v=${token}"
+stamped "$app/pkg/improvise_wasm_client.js" "improvise_wasm_client_bg.wasm?v=${token}"
+stamped "$app/worker-pkg/improvise_worker_server.js" "improvise_worker_server_bg.wasm?v=${token}"