fix(pages): deploy a committed site artifact instead of building casket-ssg in CI

[hyperpolymath]

Fixes the failure mode behind #74 (not auto-closed — #74 will be closed manually after the first verified green "GitHub Pages" run on main, per the verify-then-close discipline).

The defect

casket-pages.yml ("GitHub Pages") has 0 successes in ~93 runs, in two eras:

1. Through 2026-05-30: 46× failed at Setup Pages (Pages was not yet enabled for the repo).
2. Since then: 47× cancelled at cabal build by timeout-minutes: 15 — casket-ssg's build-depends (pandoc >= 3.0, pandoc-types, text-icu, extra-libraries: lol) cannot cold-build in 15 minutes, and no cache was ever seeded because no run ever completed.

The fix (owner ruling: "prebuild/commit the site artifact")

• site/ — the committed artifact: hand-authored static index.html (honestly labelled; makes no casket-ssg provenance claim), .nojekyll, and site/README.adoc stating the deploy-verbatim contract and how casket-ssg rendering can replace it later.
• casket-pages.yml — deploy-only: checkout → configure-pages → upload-pages-artifact → deploy-pages, one job, 5-minute timeout. Name ("GitHub Pages"), triggers, permissions, and concurrency group are unchanged.

actions.lock contract

gh actions-lock (v0.1.6) was run in this PR per the standing same-PR contract: no pin changes needed — all four remaining actions were already pinned in .github/workflows/actions.lock. The tool warns that actions/cache@v4.3.0 and haskell-actions/setup@v2.7.5 entries are now unused by this workflow but offers no prune in fix mode; the machine-managed lockfile is left untouched by hand. (Its fix mode also wants to insert a banner line above the SPDX header of all 14 workflows, which would trip the Workflow security linter's line-1 SPDX check — that churn is deliberately not committed.)

Verification plan

PR CI proves the lock/workflow parse and governance gates only — casket-pages.yml triggers on push to main. After merge: watch the "GitHub Pages" run on main (including startup_failure, which gh pr checks cannot see), confirm the deploy at https://hyperpolymath.github.io/vexometer/, then close #74 with the record.

Pre-verified enablers: Pages is enabled with build_type: "workflow"; the competing Ddraig workflow (pages.yml) is disabled_manually, so this is the only live writer to the pages concurrency group.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 9db82d63-faab-4e0e-8d27-a827f6f61e53

📥 Commits

Reviewing files that changed from the base of the PR and between 66a0fbd and 35df58f.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/casket-pages.yml
• site/.nojekyll
• site/README.adoc
• site/index.html

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}