ci: build the Pages deployment artifact

[kabudu]

Summary

• explicitly build the validated Pages deployment artifact before upload
• remove first-run Pages activation permission now that the site is enabled
• enforce validate → build → upload ordering and deploy-only Pages write access

Acceptance evidence

• python3 scripts/validate-hosted-workflows.py — passed
• python3 scripts/validate-pages-site.py — passed
• python3 scripts/build-pages-site.py — passed, 8 manifest-bound files
• ./scripts/ci-local.sh — passed on commit 3d7cdc8

Failure addressed

Enabled Pages run 31323655780 failed because validation intentionally assembled only temporary outputs while upload expected target/pages. This change makes deployment assembly explicit without weakening deterministic validation.

[kabudu]

Reviewed head 3d7cdc8d7f7bdd05b47de311489cb00b43c318f4 passed the authoritative local gate twice:

• ./scripts/ci-local.sh — passed before commit
• ./scripts/ci-local.sh — passed again at the exact reviewed head
• hosted portable CI run 31323901591 — passed
• complete remote diff inspected; no review threads or material findings

The privacy-safe local squash procedure will now create the reviewed commit on master using 3732230+kabudu@users.noreply.github.com.

[kabudu]

Merged by privacy-safe local squash commit 5a6f592 on master after complete remote-diff review and successful local and hosted CI.