ci: gate the artifact that actually ships, not only the ones in pull requests

[fas89]

scripts/check-dist-links.mjs was wired into docs-pr-check.yml alone — and that workflow is pull_request-only. So the job that uploads to GitHub Pages ran:

npm ci → npm run docs:build → touch .nojekyll → upload-pages-artifact

…with nothing between the build and the upload.

Two ways a broken site shipped past a green history

• a direct push to main was ungated entirely — docs-pr-check.yml never fires
• two PRs, each green against its own base, can combine into a broken artifact that neither run examined

Where the step goes, and why there

Between Build docs and .nojekyll — before the upload, so a bad artifact is never published rather than published and then reported.

No continue-on-error, no || true, and deliberately not if: always(). A failed build leaves no artifact, and measuring an absent or stale dist is the exact failure this exists to prevent. The script refuses to run when dist is missing, so a green result here always means it read the bytes this job is about to upload.

Verified on this branch

npm run docs:build                  exit 0
node scripts/check-dist-links.mjs   exit 0
  HTML pages walked     219   (floor 180)
  absolute, same-origin 107,738   (floor 90,000)
  distinct targets      474   (floor 400)
  resolved by rule      exact 100,779, dir index.html 6,864, extensionless +.html 95

And proved load-bearing here the same way it was in the PR workflow — link: '/why' → '/whyy' in the config.ts navbar:

npm run docs:build                  exit 0    <- the hole
node scripts/check-dist-links.mjs   exit 1    <- 424 dead references across 212 pages

Restored, rebuilt, both green again. Only deploy-docs.yml is modified; YAML re-parsed to confirm the step sits at index 4 between build (3) and .nojekyll (5), with keys name,run only.

This does not make docs-pr-check.yml redundant

The coverage map in that file says why. It reports a repository path a contributor can act on (this one reports dist paths), and it runs on a source-only change. This step is the last thing between a build and the live site.