Keep CLAUDE.md off the pkgdown site (#42)

[NewGraphEnvironment]

Closes #42.

CLAUDE.html has been live on fly's public pkgdown site. pkgdown renders every
root-level .md except a hardcoded allowlist, and there is no config option to exclude
one — .Rbuildignore governs R CMD build, not the docs site.

Three changes, and the first alone would not have worked

rm -f CLAUDE.md before build_site()	stops all three copies being produced — the rendered page, a markdown twin served as-is, and the search index (227 hits for CLAUDE). Deleting only CLAUDE.html looks like a fix and achieves nothing
an allowlist gate after the build	closes the mechanism, not one file. Without it the next root-level .md anyone adds leaks silently — which is how this went unnoticed here
clean: true on the deploy	with clean: false the action never deletes, so removing the file from the build would have left the published copies exactly where they are

Checked before flipping clean

clean: true deletes anything on gh-pages not present in docs/, so:

• no CNAME (404) — the custom domain comes from the org site repo, nothing to break
• no dev/ — no versioned docs to lose
• docs/ is untracked (0 files in git), so the whole site is CI-generated and nothing
  on the branch is a hand-added asset

Verified, not reasoned

pkgdown:::package_mds() — the function that actually makes this decision — returns
CLAUDE.md and nothing else for this repo, and returns none once the file is gone.

The gate was extracted verbatim from the YAML that ships rather than retyped, and run
against five cases:

case	expected	got
clean site	0	0
CLAUDE.html present	1	1
only CLAUDE.md present	1	1
both copies	1, named once	1, named once
empty docs/	1	1
a page named authors index	1	1
a page named index.md.html	1	1
a glob metacharacter in a filename	1	1
a plausible future root page (NOTES)	1	1

Two of these were failures the first time. The gate went through two rounds, and
neither weakness was visible by reading:

• the first draft looped over docs/*.html and exited 0 on an empty docs/ — an
  affirmative claim of success about a build that produced nothing
• the second used case " $allowed " in *" $b "*), which reads like a token test and is
  a substring test, so authors index passed. Stripping both suffixes
  unconditionally had the same shape, reducing index.md.html to index

Both fail toward pass. Neither is reachable through pkgdown today — R CMD check
rejects a filename with a space — so this was a guard weaker than it read rather than a
live leak. Worth fixing anyway, since the entire value of the step is that someone trusts
it a year from now. A loop over nothing exits 0, so without an explicit
population check a build that produced no site at all would have reported "Root pages are
all declared" — a guard making an affirmative claim of success about work that never
happened. The gate now fails on a missing docs/index.html first.

The pull_request trigger runs the build and the gate (deploy is skipped), so this PR's
own CI exercises both.

Not a release

.github/ is in .Rbuildignore, so the built package is byte-identical to v0.7.0. No
NEWS entry, no version bump, no tag — there is nothing a user could observe.

After merge

The first deploy with clean: true removes the published copies. Worth confirming
https://www.newgraphenvironment.com/fly/CLAUDE.html returns 404 afterwards, and that
search.json no longer carries the text. De-indexing is a separate Search Console
request, and only after the URL 404s — a robots.txt block first would stop crawlers
seeing the 404 and keep stale entries alive longer than doing nothing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GBKqedyBysV7hB4DuL98ZR