chore(ci): Chain Pages deploy from release-tag.yml and adopt org refinements

release: published events triggered by secrets.GITHUB_TOKEN do not start new workflow runs (only workflow_dispatch and repository_dispatch are exceptions). The Pages workflow's release: published trigger would never have fired in production since release-tag.yml's softprops/action-gh-release uses GITHUB_TOKEN to publish.

Fix: drop the release: published trigger and have release-tag.yml's release-github job explicitly run gh workflow run pages.yml --ref main after the release is created. release-github gains actions: write to authorize the dispatch.

Also adopts refinements from sibling org PRs (permission-pilot#356, bluemusic#220):

- Top-level permissions reduced to contents: read; pages: write and id-token: write moved to the deploy job only (least privilege)

- JEKYLL_GITHUB_TOKEN on the build step so jekyll-github-metadata authenticates when fetching site.github.releases

- Sanity-check step (test -f _site/index.html && _site/CNAME) fails fast if Jekyll produced nothing

- Explicit upload-pages-artifact path: ./_site matches the build's destination

- Verify fastlane Bundler wiring step (bundle exec fastlane --version) lets workflow_dispatch dry_run=true exercise the relocated Gemfile before the next real release

.github/workflows/pages.yml

@@ -1,14 +1,10 @@
 name: Deploy GitHub Pages
 
 on:
-  release:
-    types: [ published ]
   workflow_dispatch:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -32,14 +28,24 @@ jobs:
         with:
           source: ./
           destination: ./_site
+        env:
+          JEKYLL_GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Sanity-check Jekyll output
+        run: test -f _site/index.html && test -f _site/CNAME
 
       - name: Upload Pages artifact
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 #v5.0.0
+        with:
+          path: ./_site
 
   deploy:
     name: Deploy to GitHub Pages
     needs: build
     runs-on: ubuntu-22.04
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/release-tag.yml

@@ -19,6 +19,7 @@ jobs:
     name: Create GitHub release
     permissions:
       contents: write
+      actions: write
     runs-on: ubuntu-22.04
     environment: foss-production
     steps:
@@ -83,6 +84,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Trigger GitHub Pages deployment
+        if: "!(github.event_name == 'workflow_dispatch' && inputs.dry_run)"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh workflow run pages.yml --ref main
+
   release-gplay:
     name: Create Google Play release
     runs-on: ubuntu-22.04
@@ -126,6 +133,9 @@ jobs:
           bundler-cache: true
           working-directory: fastlane
 
+      - name: Verify fastlane Bundler wiring
+        run: bundle exec fastlane --version
+
       - name: Assemble beta and upload to Google Play
         if: contains(github.ref_name, '-beta') && !(github.event_name == 'workflow_dispatch' && inputs.dry_run)
         run: bundle exec fastlane beta