Enable GitHub Pages deployment

[kabudu]

Summary

• grant the Pages build job only contents: read and pages: write
• ask the commit-pinned GitHub configure action to enable Pages on first deployment
• validate both first-run controls locally

Validation

• ./scripts/ci-local.sh passed before commit
• no secrets or contents-write permission are exposed

[kabudu]

Final reviewed head: 55d8e52. ./scripts/ci-local.sh and hosted CI run 31322849981 both passed on the clean head. The diff grants only pages: write to the build job and enables first-run Pages setup through the pinned GitHub-owned action; it exposes no secrets or contents-write permission.

[kabudu]

Merged via the repository privacy-safe procedure as commit f48f5ad on master.