fix(ci): pages-deploy needs every check job, and README names them all (improvise-x7cq)

kb was the one job absent from the needs list, on the unstated ground that
kb.pl is not shipped by the site. harness-lint's crate is not shipped either and
was in the list, so the ground proved too much. A failing knowledge-base
consistency check means main is broken, and publishing from a broken main is
what the list exists to stop. The rule that does not go stale is "every check
job", so that is what the comment says.

README named three of the seven, which read as a promise the other four were
ungated -- and it is the shape gotcha 48 is about: a fact stated in two places
where changing one is an edit rather than a grep. It now names the rule and the
list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

.github/workflows/ci.yml

@@ -397,9 +397,15 @@ jobs:
   # between upload and deploy — 182s before, ~115s after, on the run 35535225637
   # shape — so the window in which a superseding run can expire this run's
   # artifact is smaller. It does not close the race; it does not widen it.
+  # `needs` is EVERY check job, which is the only rule that does not go stale.
+  # `kb` was the one absent, on the unstated ground that kb.pl is not shipped by
+  # the site — but neither is `harness-lint`'s crate, and it was in the list, so
+  # the ground proved too much (improvise-x7cq). A failing consistency check
+  # means main is broken, and publishing from a broken main is what this list
+  # exists to stop.
   pages-deploy:
     name: Deploy to GitHub Pages
-    needs: [test, wasm, js, browser, harness-lint, build]
+    needs: [test, wasm, js, browser, harness-lint, kb, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions: