docs: retire SMS program website content

[xnoto]

Summary

Owner-approved follow-up to the messaging retirement audit. The SMS backend was already retired; these public website pages still described an available SMS program. No issue is linked.

• Delete makeitwork.cloud/sms.html and remove its navigation links and sitemap entry.
• Update privacy.html and terms.html to describe the retired program, with October 5 review dates. Preserve general privacy/terms, the no-share/sell mobile-number and messaging-consent commitment, and existing retention language. Historical SMS references intentionally remain; they do not advertise enrollment.
• Bump the existing service-worker cache name from v3 to v4 so activation discards previously cached pages. No service-worker algorithm changes.

Discord alerting, the portal Discord profile link, Discord MCP PR269, OpenCode, Twilio accounts/credentials, and infrastructure configuration remain unchanged.

Type of change

• Documentation
• Refactor / cleanup
• Breaking change — removes the retired /sms.html URL

Validation

• Observed static-checks passed at 8d2ed814819e64d0d00aaa935f6be0b7315bdd68: CI37260754414. Initial run failed only because Prettier collapsed the privacy meta tag; its exact formatting correction is the sole post-review change.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — none changed

Adversarial-code and DevOps reviews of the completed five-file diff at 74e29ead7e96d7bc2d8941495410bc3cb93a133b advanced with no Critical/High findings. QA found expected coverage gaps: PR pre-commit hygiene/format/security checks and node --check do not prove public URL removal, HTML-link correctness or browser cache migration. Source inspection confirmed only the intended replacements; no local execution is claimed.

Impact and rollout

Canonical owner: makeitworkcloud/www, target main. Producer: static website source. Consumers: existing S3 sync, Cloudflare edge, website browsers/service worker. No chart/image publication, new dependency, custom automation, generated copy or GitOps handoff.

Merge automatically deploys both site directories with S3 --delete semantics and then purges Cloudflare. Owner explicitly confirmed merge and automatic deployment/cache purge. PR authorship/review is complete; PR CI passed; publication and bounded live verification are completed as recorded below. Onion source and all deployment workflows/credentials remain unchanged, although the existing workflow still syncs both sites.

After an approved merge, verify the deploy workflow, confirm /sms.html no longer serves the old program (do not assume a particular origin/CDN error status), verify privacy/terms return the retired-program text and retained commitments, confirm no retired URL in legal navigation/sitemap, and confirm v4 service-worker delivery. Browser verification should cover an existing v3 installation updating/activating and the old caches disappearing. Clients that remain offline or have not installed the new worker may retain old content; Cloudflare purge alone does not purge browser caches. Verify the portal and retained profile links still work.

Rollback requires an explicitly approved source revert/redeploy. Restoring obsolete active-program language is not recommended. If reverting the worker, use a fresh cache version rather than promising restoration of old browser caches. No provider-data deletion, account closure, token revocation or legal-compliance claim is made by this cleanup.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — not applicable
• Breaking or irreversible effects are described above with rollback notes

AI-assisted implementation and specialized reviews.

Verified deployment outcome

Merged to www/main at 981fa198c787af6793a9ccc220c598b45c56d542. Deploy37263053780 succeeded, including static checks, worker syntax, both site synchronizations and Cloudflare purge.

Public edge and browser checks: /sms.html404; privacy/terms200 with retirement language; privacy non-sharing and retention commitments retained; sitemap200 without the retired URL; portal200 with Discord profile link retained; sw.js200 with cache v4. Browser inspection confirmed an activated controlling service worker and only miw-cache-v4 visible. This is fresh-session verification, not proof that existing/offline owner devices have migrated from v3. No external account closure or token revocation is claimed.