Add GitHub Pages previews for pull requests

[jonabur]

PR builds currently produce a downloadable dashboard but no hosted review page. Add GitHub Pages previews at pr-preview/pr-<number>/, with a Pages preview check linking to each deployed PR and an index showing the exact built commits.

The existing build continues to run the full checks and package its four static files. A separate publisher executes default-branch code after build completions and PR closures. It combines the latest successful main build with previews for all open PRs, including forks, then deploys one Pages site. PR builds retain read-only repository permissions; the publisher reads their artifacts as data and never executes PR code.

Generated snapshots persist on an automatically created pages-content branch. Each publish reconciles all open PRs under a single concurrency group, preserving production and other previews across updates, retaining previous successful builds when new builds fail, and removing closed PRs. Preview artifacts are validated for expected files, regular-file types, duplicate/path violations, and bounded sizes before installation. Source build artifacts are retained for 30 days; published snapshots survive artifact expiry.

Pages stays configured with GitHub Actions as its source, and the github-pages environment remains restricted to main. No extra service or secret is required. This infrastructure PR must merge before the trusted publishing workflow can run; its first deployment can pick up existing successful artifacts for PRs #10 and #11 while those feature PRs remain open.

Validation:

• python3 -m tests.check passes: 70 Python tests, 103 JavaScript tests, and the public browser suite.
• Publisher regressions cover archive rejection, production/preview updates, retained snapshots, closed-PR cleanup, stale main runs, fork repository/commit matching, check links, Git state-branch round trips, and workflow trust boundaries.
• Browser coverage follows the generated preview-index links and confirms that production and preview pages retain their separate model selections and scores, using fictional fixtures.
• actionlint passes for both workflows.
• Read-only rehearsal assembled the current main build and real artifacts for PR Refresh LUMI results and use corrected CoT evals by default #11 and fork PR Separate global_piqa from piqa, and split nno and nob #10; preview-check API reads also passed with writes mocked.

Actual Pages deployment and the resulting PR check links are verified after this workflow reaches main.