pkgdown publishes CLAUDE.md: add the pre-build removal and allowlist gate #50

What changes if we do it

CLAUDE.md stops being published on the pkgdown site, and a declared allowlist
means a future root-level markdown file cannot leak silently.

What happens if we never do

CLAUDE.html stays live, and anything added to CLAUDE.md publishes
automatically the next time the site builds. drift is a public repo, so
there is no incremental exposure today — the same content is already readable in
the repo. The cost is that the gate the convention prescribes does not exist, so
the protection depends on drift staying public and its CLAUDE.md staying
innocuous.

Current state

$ curl -sL -o /dev/null -w '%{http_code}' https://www.newgraphenvironment.com/drift/CLAUDE.html
200
$ curl -sL https://www.newgraphenvironment.com/drift/CLAUDE.html | grep -ci sred
7
$ grep -n CLAUDE .github/workflows/pkgdown.yaml
(no match)

pkgdown:::package_mds() renders every root-level .md except a hardcoded
allowlist (README, LICENSE, NEWS, two GitHub templates). There is no config
option to exclude a file, and .Rbuildignore does not apply — pkgdown reads the
source tree, not the tarball.

Fix, per soul/conventions/pkgdown-publishing.md

Two steps, both in .github/workflows/pkgdown.yaml:

1. Remove before the build, not after. There are three published copies —
   CLAUDE.html, a verbatim CLAUDE.md, and the text inside search.json — so
   deleting the rendered page afterwards fixes one of three.

   - name: Keep internal notes out of the published site
     run: rm -f CLAUDE.md

2. Gate on a declared allowlist, so a new root markdown file fails the build
   rather than publishing. Test it against both known answers before trusting it:
   it must exit non-zero on a site that contains the file and zero on one that
   does not.

Also worth checking while there: whether the deploy action uses clean: true.
With clean: false nothing is ever deleted from gh-pages, so removing the file
from source does not unpublish it — the stale copy needs an explicit purge.

Not urgent

Filed from /compact-prep rather than fixed inline: it is a workflow change
unrelated to the branch that surfaced it (#47), and it wants the two-answer test
on the guard rather than a drive-by edit.