Publish one bundle version to both OTA origins, not two (#11291)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/bundleUpdate.sh

@@ -14,7 +14,11 @@ if [ -z "$RUNTIME_VERSION" ]; then
 fi
 
 cd bundleTempDir || exit
-BUNDLE_VERSION=$(date +%s)
+
+# Shared with denisPublish.sh when both run in one job -- see the note there.
+# Both origins must receive the same bundle version for the same bytes, because
+# the version is part of the asset URL path.
+BUNDLE_VERSION="${BUNDLE_VERSION:-$(date +%s)}"
 
 # This MUST address ota1's own origin hostname, never updates.bsky.app.
 #

scripts/denisPublish.sh

@@ -19,7 +19,16 @@ if [ -z "$RUNTIME_VERSION" ]; then
   RUNTIME_VERSION=$(cat package.json | jq '.version' -r)
 fi
 
-BUNDLE_VERSION=$(date +%s)
+# Accept a caller-supplied bundle version so that a dual-write publishes the SAME
+# version to every origin. When this script and bundleUpdate.sh each called
+# `date +%s` independently they produced versions seconds apart for identical
+# bytes -- observed 1785102575 (denis) vs 1785102614 (ota1) for one commit. Since
+# the version is part of the asset URL path, the two origins then served
+# manifests pointing at paths only one of them had, so the manifest and its
+# assets had to come from the same origin or the fetch 404s. Falling back to
+# `date +%s` keeps standalone callers (PR previews, `pnpm make-deploy-bundle`)
+# working unchanged.
+BUNDLE_VERSION="${BUNDLE_VERSION:-$(date +%s)}"
 DENIS_CDN_DOMAIN="${DENIS_CDN_DOMAIN:-updates.bsky.app}"
 DENIS_S3_BUCKET="${DENIS_S3_BUCKET:-bsky-denis-ota-prod}"