fix(deck): check the export in the pull request instead of pushing to main

[desek]

The defect

The Docs Deck workflow rebuilt the deck export on main and pushed the result. It cannot. The default branch ruleset requires every change to arrive through a pull request, and the Actions token has no bypass for that rule:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Changes must be made through a pull request.

A user-owned repository cannot grant the bypass either: the list offers repository roles, deploy keys, and installed GitHub Apps, and the Actions token is none of those.

The failure was near-silent. The one earlier run looked successful only because the export happened to be current, so the job hit its git diff --quiet guard and never reached the push. The first run that had real work to publish, on the merge of the iteration-session retuning, failed at that step and left docs/deck/checkpoint-distill.html stale on main, still rendering the removed disposition labels.

The fix

The workflow now checks freshness instead of producing it. On a pull request touching deck/, docs/deck/, or the workflow itself, it rebuilds the export and fails when the committed file does not match. The author commits the rebuilt export alongside the deck change, so it travels in the same pull request as its source and cannot go stale on main without a red check. The token drops to contents: read, and no credential that can write to main is stored anywhere.

The failure message carries the fix, because the reader of a red check is the party who has to repair it.

Also in this pull request

• docs/deck/checkpoint-distill.html rebuilt from current source. It carries the retuned ledger fragment and no longer shows disposition: labels.
• deck/README.md updated: publishing is a manual commit, and the record of why the push cannot be automated travels with it.

Verification

• npm run build:single && npm run export:html && npm run check:export run locally. The check reports "export opens from disk, 8 pages, all with content".
• grep -c disposition docs/deck/checkpoint-distill.html returns 0.
• bats -r tests/ passes 124 of 124.
• This pull request touches deck/ and docs/deck/, so the rewritten workflow runs against itself here.