Phase 1 blob broadcast: worker → Vercel Blob + revalidate hook (no reader switch)

[Flotapponnier]

Phase 1 of the SRH replacement roadmap

Goal: eliminate SRH from the site's hot read path by having the materialize worker publish an aggregate JSON snapshot to Vercel Blob every 60 s, and having the site read that Blob (CDN-cached) instead of fanning out ~150 concurrent Redis GETs on every homepage render. This PR ships the write side only. The read side flips in a follow-up PR under a feature flag once we've observed writes are healthy.

What this PR does

1. worker/publish-blob.ts (new) — reads all 68 unfiltered bench snapshots back from Redis (worker uses TCP direct via OCB_REDIS_URL, never SRH), assembles a single { v, builtAt, benches[] } envelope, put() to Vercel Blob at bench-aggregate/latest.json (access: public, cacheControlMaxAge: 60, addRandomSuffix: false, allowOverwrite: true). Then POSTs the site's revalidate hook.

2. worker/index.ts — calls publishAggregateBlob(specs) after tier A completes. Gated on BLOB_READ_WRITE_TOKEN being set so the change is a no-op until the env is provisioned.

3. src/app/api/internal/revalidate-aggregate/route.ts (new) — POST handler that verifies a bearer token (REVALIDATE_TOKEN) with timingSafeEqual, then calls revalidateTag('bench-aggregate', 'default'). Purges the CDN cache tag immediately so the site doesn't wait the ~60 s Blob overwrite propagation window.

4. @vercel/blob added to dependencies (v1). pnpm-lock.yaml regenerated.

Zero user-visible effect until step 2 ships

• Site's read path unchanged (still uses loadAllBenchmarksSafe → Redis via SRH). Even if the Blob write silently fails every cycle, nothing on prod breaks.
• Worker gains one outbound HTTPS call to Blob per cycle (~200 ms) and one to the site (~50 ms). Neither in the sweep hot path.

Env vars to provision after merge

VPS worker (/run/ocb/.env.materialize-worker):

• BLOB_READ_WRITE_TOKEN — from Vercel Blob store (create via Vercel Dashboard → Storage → Blob)
• SITE_URL — https://openchainbench.com
• REVALIDATE_TOKEN — shared secret with the site (any random 32-byte hex)

Vercel site (vercel env add):

• REVALIDATE_TOKEN — same value as the worker

Then rebuild worker container on VPS: ssh -p 8822 rescue@57.130.61.201 "cd /opt/ocb && docker compose up -d --build materialize-worker".

Observation checklist

Once envs are in place and worker restarted, watch:

• docker logs -f ocb-materialize-worker | grep 'blob published' — should log every 60 s
• Vercel Blob dashboard should show bench-aggregate/latest.json refreshing
• Vercel site logs should show POST /api/internal/revalidate-aggregate 200 every 60 s
• Homepage behavior unchanged

Follow-up PRs (roadmap)

• PR-B (Phase 2): site reads loadAggregateFromBlob() behind AGG_SOURCE=blob flag, shadow-mode logging for parity
• PR-C (Phase 3): flip flag to blob on prod
• PR-D (Phase 4): TLS-expose Redis publicly, set OCB_REDIS_URL on Vercel, unset SRH env, retire SRH container + auto-heal cron

[Flotapponnier]

Pivoting to VPS-served aggregate (nginx static file) — self-hosted, $0, no vendor lock-in, no Blob propagation delay. New PR incoming with worker writing local JSON + nginx vhost.