ci: isolate deployment from existing IIS sites

README.md

@@ -79,9 +79,11 @@ Move generated file to `app/controllers/`.
 
 ## Deployment
 
-Production deployment uses full-repository immutable release directories while IIS points only at each release's `public/` directory. `scripts/deploy-iis-git.ps1` packages and transfers a reviewed checkout to `webserver-1` over Tailscale/OpenSSH; `scripts/install-iis-release.ps1` performs host preflight, preserves the machine-owned `public/web.config`, enables Classic ASP parent paths, switches releases, smoke tests, and supports rollback. Database migrations are disabled by default.
+Production deployment owns an isolated IIS site and app pool; it never targets, adopts, or copies configuration from another site. Defaults are `SiteName=AspClassicUnifiedFramework`, `AppPoolName=AspClassicUnifiedFramework`, `DeployRoot=D:\Deployments\AspClassicUnifiedFramework`, and HTTP binding `100.97.39.23:8085` with an empty host header. Every value is explicitly overridable, while mismatched existing target state fails closed.
 
-Gitea 1.11.4 has no Gitea Actions, so run the controller script from a trusted external CI worker or operator workstation. Start with `-DryRun`, which makes no network connection. See [docs/deployment-guide.md](docs/deployment-guide.md) and [docs/deployment-configuration.md](docs/deployment-configuration.md).
+The complete repository is retained in immutable release directories and IIS serves only each release's `public/` directory. First deployment initializes shared configuration from packaged `public/web.config` unless `-InitialWebConfigPath` is supplied. The target site/app pool is created only after the staged release validates; Classic ASP parent paths are enabled only at that site's location. Failure cleanup is limited to target resources created by the current invocation, or restoration of the prior valid target state. Migrations remain disabled by default.
+
+Run `scripts/deploy-iis-git.ps1 -LocalPreflightOnly` for local source/XML/package/safety validation with no network access. When host access is permitted, run `-PreflightOnly` for the complete check: it streams the installer without writing remote files and validates IIS features/modules, binding and shared-pool conflicts, drive/path, names, and target state without requiring the target to exist or making IIS/deployment changes. `-HostPreflightOnly` and `-RemotePreflightOnly` remain aliases. Gitea 1.11.4 has no Gitea Actions, so use a trusted external worker or operator workstation. See [docs/deployment-guide.md](docs/deployment-guide.md) and [docs/deployment-configuration.md](docs/deployment-configuration.md).
 
 ## Testing