ci: build the site and smoke-check it in a real browser

A green build cannot tell you the page renders. A Dependabot PR that bumped
react without react-dom built clean in RFutils and left the hosted page
showing only its footer from 2026-08-11 until an outside user reported it.
This installs with a plain npm ci, checks the lockfile matches the manifest
(npm ls), builds, then loads the built site in headless Chromium and fails
on any runtime error or an empty root.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: stoatworks-labs

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: ci
+
+# What a green build cannot tell you: that the site renders. A Dependabot PR that
+# bumped react without react-dom built clean in RFutils and left the hosted page
+# empty for three weeks. So this installs with a plain `npm ci` (no
+# --legacy-peer-deps: a bump that only installs with it is a bump that breaks the
+# stack), checks the lockfile actually matches the manifest, builds, and then
+# loads the built site in a real browser and fails on any runtime error.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - name: Install
+        run: npm ci
+      - name: Lockfile matches manifest
+        run: npm ls --all >/dev/null
+      - name: Build
+        run: npm run static:build
+      - name: Smoke-check the built site
+        uses: stoatworks-labs/smoke-check@v1
+        with:
+          dir: out-static