[alanw707]

Summary

• use dedicated least-privilege shop FTPS credentials for the newsletter asset
• preserve the existing main-site theme deployment target
• enforce TLS verification, the pinned Hostinger endpoint, and the exact root filename
• support and test root-relative one-file deployments
• remove obsolete theme-derived plugin path logic

Evidence

• restricted account read verified against reviewed original SHA-256 f3873bf2cdef7967a6d227a66d46ce6076a42ec6b660416e0b6a8379f1134cc3
• follow-up subagent review: PASS
• bash tests/scripts/deploy-file.test.sh passes
• workflow YAML parse, syntax checks, and git diff --check pass