fix(pages): publish .well-known — the upload was stripping it (#105)

The canonical bundle was reaching `_site` and then being deleted on the
way out.

`actions/upload-pages-artifact` defaults to `include-hidden-files:
false`, and
its archiving step is a `tar` that carries `--exclude=.[^/]*`. That
pattern
matches every top-level entry beginning with a dot, so `.well-known/`
was
stripped from the artifact after the overlay step had placed it
correctly.

Evidence from the last run of `pages.yml` — the job's own output:

```
published tree:
_site
_site/.well-known
_site/.well-known/ai.txt
_site/.well-known/humans.txt
_site/.well-known/security.txt
```

...followed by a successful upload and a successful deploy, and then a
404 at
`/.well-known/security.txt`. The overlay is not at fault; the upload is.

`include-hidden-files: true` publishes dot-entries deliberately. `.git`
and
`.github` remain excluded by the action regardless.

Confirmed by contrast: `ubicity`, the only repository in the estate that
hand-rolls its `tar` (for SHA-pinning reasons), is the only one serving
`security.txt`.

Author: hyperpolymath

.github/workflows/pages.yml

@@ -71,6 +71,10 @@ jobs:
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: '_site'
+          # actions/upload-pages-artifact strips dot-entries by default
+          # (its tar runs --exclude=.[^/]*), which silently removed
+          # .well-known/ from the artifact. Publish it deliberately.
+          include-hidden-files: true
   deploy:
     environment:
       name: github-pages