docs(ci): record the build job and the now-required build check

[wormeyman]

Follow-up to #64 and #65. Three claims went stale the moment those merged, and all three read as current fact:

• verify.yml's header still listed pnpm vp build under "what is deliberately NOT here", 90 lines above the job that runs it.
• Its concurrency comment still said strict_required_status_checks_policy is false. Ruleset EJ has had strict: true since chore(renovate): automerge GitHub Action digest re-pins, and only those (#62) #65's prerequisite landed - which is the whole reason the automerge rule was safe to add. The rationale for not cancelling main runs survives (a per-commit verdict on main is still the thing that proves it), so it is corrected, not deleted.
• CLAUDE.md said the same thing about the build being absent, plus "the build stamp reads git history" - measured wrong in ci(build): run pnpm vp build - verify never did (#61) #64. It reads git state: rev-parse HEAD, rev-parse --short HEAD, status --porcelain.

Also records what actually happened after the merges:

• build is now a required check in ruleset EJ, added after ci(build): run pnpm vp build - verify never did (#61) #64 was green on main. The table says verify + build.
• The two-step ordering, because getting it backwards is self-blocking: requiring a check that does not exist on main blocks the PR that introduces it. Plus the PUT-replaces-rules gotcha, and the strict: true side effect that every other open PR needs Update branch after any merge.

Docs and comments only - no workflow behaviour changes.