The demo and staging sites ran on the free tier, so uploads and the other licensed features were unavailable to anyone looking at them. The Sites job now mints a self-contained key pair (site_id 123, the estate's SYSSITE) into the drive before the snapshot, so both sites are fully usable. Minted per deploy rather than committed, and the CI estate stays unlicensed so the specs keep exercising the free tier.