feat(site): deploy to GitHub Pages (phase 4)

[TMHSDigital]

Phase 4: deploy. Merging this publishes the site at https://tmhsdigital.github.io/plumbline/.

Pages was already enabled with build_type: workflow (source: GitHub Actions, not a branch). Nothing had been deployed, so no settings change was needed.

site.yml now has three jobs:

• parity (name unchanged, so required checks are unaffected): the fixture check, the build, and the floor.js parity check. It then uploads the assembled site with upload-pages-artifact@v5. On a PR, that artifact is a downloadable preview.
• docs (new, needs parity): runs the renderer self-test, then unpacks the exact archive that gets deployed and runs scripts/check_site_links.mjs on it.
• deploy (needs parity and docs): runs only on push to main or workflow_dispatch on main, never on pull requests. It has pages: write and id-token: write, the github-pages environment, and its own non-cancelling pages concurrency group.
• Workflow-level cancel-in-progress now applies to pull requests only, so a deploy on main is never cut off part way.

scripts/check_site_links.mjs (standard library only) takes a directory or a URL. It starts from the explainer, follows every internal link, and fails on:

• an internal link, stylesheet, script or image that doesn't resolve, or an #anchor with no matching id;
• anything loaded from another origin (outbound <a> links are fine);
• a page missing its canonical, og:* or twitter:* tags, or whose canonical and og:url don't name that page;
• an og.png that isn't a 1200x630 PNG;
• a broken 404 page, checked as if served at a deep missing path. Against the live URL it also requires a real 404 status.

Tested locally: a missing page, a bad anchor, a CDN stylesheet and a wrong og:url were each reported, and the real build passes (11 pages).

Meta. Every page has <link rel="canonical"> plus Open Graph and Twitter summary_large_image tags pointing at tmhsdigital.github.io/plumbline. The doc pages get them from build_site.social_meta. The explainer, which is static HTML, has the same tags generated from that function once and committed.

Card image. site/og.png is 1200x630 and 45 KB. It was rendered from scripts/og_image.html in a headless browser, and that file says how to regenerate it. It shows the title, the worked example's ECE (0.074) and the floor's 95th percentile (0.111) on a scale at their true positions, and "105 rows: inconclusive, not a pass". It is plain, with no emojis and no external image service.

404. 404.html uses absolute /plumbline/ paths, since Pages serves it at any depth. It links back to the explainer and the docs, and it is noindex.

README. A link to the site sits right under the one-line description.

Checked locally: ruff, format, mypy --strict, the renderer self-test (15 cases), the build, the parity check, the site checker, and the em dash guard all pass.

After merge I will set the repo's About homepage and verify the live site.

🤖 Generated with Claude Code