fix(ci): pages-deploy needs every check job, and README names them all (improvise-x7cq)

kb was the one job absent from the needs list, on the unstated ground that
kb.pl is not shipped by the site. harness-lint's crate is not shipped either and
was in the list, so the ground proved too much. A failing knowledge-base
consistency check means main is broken, and publishing from a broken main is
what the list exists to stop. The rule that does not go stale is "every check
job", so that is what the comment says.

README named three of the seven, which read as a promise the other four were
ungated -- and it is the shape gotcha 48 is about: a fact stated in two places
where changing one is an edit rather than a grep. It now names the rule and the
list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

.github/workflows/ci.yml

@@ -397,9 +397,15 @@ jobs:
   # between upload and deploy — 182s before, ~115s after, on the run 35535225637
   # shape — so the window in which a superseding run can expire this run's
   # artifact is smaller. It does not close the race; it does not widen it.
+  # `needs` is EVERY check job, which is the only rule that does not go stale.
+  # `kb` was the one absent, on the unstated ground that kb.pl is not shipped by
+  # the site — but neither is `harness-lint`'s crate, and it was in the list, so
+  # the ground proved too much (improvise-x7cq). A failing consistency check
+  # means main is broken, and publishing from a broken main is what this list
+  # exists to stop.
   pages-deploy:
     name: Deploy to GitHub Pages
-    needs: [test, wasm, js, browser, harness-lint, build]
+    needs: [test, wasm, js, browser, harness-lint, kb, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:

README.md

@@ -181,8 +181,10 @@ improvise script setup.txt -f model.improv
 
 The browser page is at **<https://fiddlerwoaroof.github.io/improvise/app/>**,
 built and published from `main` by the `build` / `pages-deploy` jobs in
-`.github/workflows/ci.yml`. A deploy only happens after `cargo test`, the
-wasm32 check and the Playwright browser harness have passed.
+`.github/workflows/ci.yml`. A deploy only happens after **every** check job in
+that workflow has passed — `test`, `wasm`, `js`, `browser`, `harness-lint`,
+`kb` and `build`. Naming a subset is how that list went stale before: three of
+the seven were listed and the rest read as ungated.
 
 The site **root** is the landing page — `docs/index.html`, with the recorded
 terminal casts — and it links to the app. `web/assemble.sh` puts the two