fix(ci): pages-deploy needs every check job, and README names them all (improvise-x7cq)

kb was the one job absent from the needs list, on the unstated ground that
kb.pl is not shipped by the site. harness-lint's crate is not shipped either and
was in the list, so the ground proved too much. A failing knowledge-base
consistency check means main is broken, and publishing from a broken main is
what the list exists to stop. The rule that does not go stale is "every check
job", so that is what the comment says.

README named three of the seven, which read as a promise the other four were
ungated -- and it is the shape gotcha 48 is about: a fact stated in two places
where changing one is an edit rather than a grep. It now names the rule and the
list.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FC2jVn8Au7E9JPkw6bwXXH

README.md

@@ -181,8 +181,10 @@ improvise script setup.txt -f model.improv
 
 The browser page is at **<https://fiddlerwoaroof.github.io/improvise/app/>**,
 built and published from `main` by the `build` / `pages-deploy` jobs in
-`.github/workflows/ci.yml`. A deploy only happens after `cargo test`, the
-wasm32 check and the Playwright browser harness have passed.
+`.github/workflows/ci.yml`. A deploy only happens after **every** check job in
+that workflow has passed — `test`, `wasm`, `js`, `browser`, `harness-lint`,
+`kb` and `build`. Naming a subset is how that list went stale before: three of
+the seven were listed and the rest read as ungated.
 
 The site **root** is the landing page — `docs/index.html`, with the recorded
 terminal casts — and it links to the app. `web/assemble.sh` puts the two