CI checks do not cover everything that ships

[TMHSDigital]

The problem

• The em-dash check (ci.yml:141) covers only *.md and src/. It skips site/index.html, the page prose in scripts/build_site.py, scripts/og_image.html and the issue templates, and it does not catch — or \u2014. -- is also used as a stand-in in METHODOLOGY.md (lines 68, 159, 194, 359, 397, 401) and in loader output (loader.py:226). There are no real violations today.
• check_site_links.mjs does not check URLs that JavaScript loads (floor-worker.js, example-run.json).
• site.yml does not run the link check against the live site after deploy.
• There is no browser test of the page (see the "[object Object]" bug).

What done looks like

• The em-dash check covers all shipped text, including the site and templates, and the entities. Decide whether -- as prose punctuation is also banned, and fix the existing ones if so.
• The link checker covers JS-loaded paths.
• A post-deploy job runs the link check against the Pages URL.
• A small Playwright smoke test: load the page, run the calculator once, submit one invalid value.

[TMHSDigital]

Partly addressed by the site upgrade stack:

• feat(site): search the explainer and the docs (phase 6) #69 adds scripts/check_search.mjs, which checks that the files the page scripts load exist in the built site (floor-worker.js, example-run.json, search-index.json). check_site_links.mjs can't see those, because it only follows HTML tags.
• feat(site): the explainer's opening, a CSP on every page, and the calculator fixes (phase 7) #70 makes check_site_links.mjs require the site's Content-Security-Policy on every page, and fail on inline scripts, style blocks, or style attributes.

Still open: the em-dash check doesn't cover the site, the link check doesn't run against the live URL after deploy, and there's no browser smoke test in CI.

[TMHSDigital]

#71 landed the rest of this:

• scripts/smoke_site.mjs drives the runner's own Chrome over the DevTools protocol, with nothing installed. It checks the calculator, a shared link, and search, and fails on any console error or CSP violation on any page. It runs before every deploy.
• A live job after the deploy runs check_site_links.mjs against the Pages URL, including the real 404.
• The em-dash check now covers site/, scripts/ and .github/, plus the HTML entity and JS escape spellings.

One thing is left: whether -- used as prose punctuation should be banned too. It stands in for an em dash in 22 places, including METHODOLOGY and one report string in src/plumbline/datasets/loader.py, and changing that string means regenerating docs/example-report.md. Leaving this open for that decision.