ci: test every PR and deploy main automatically

[TueJon]

The site had no CI and no deploy pipeline: tests ran only when someone remembered, and every merge needed a manual git pull on the host.

.github/workflows/site.yml:

• test runs on every PR and push: the 53 contract tests, plus a check that de/index.html and the WebMCP manifest regenerate without a diff.
• deploy runs on every push to main once the tests pass, serialized by a concurrency group. It pulls main into /opt/webmcpify on the host through a restricted deploy key, whose forced command only runs git pull --ff-only and prints the deployed HEAD. The job fails unless the deployed commit contains the pushed one, then verifies HSTS and that every public route returns 200.

Both jobs run on the repo's self-hosted tuejon-ci runner and skip pull requests from forks. The repository now also requires approval before workflows run for any outside contributor. The README's Deploy section describes the pipeline, with the manual command kept as a fallback.

Validation: tests 53/53 and the generated-file check pass locally. The restricted key was verified to ignore any requested command and return only the deployed commit. All eight routes return 200 today. Merging this PR exercises the deploy job for the first time.

[TueJon]

.github/workflows/site.yml:50 — The automatic deploy can report success after either legal page disappears. /imprint.html and /privacy.html are public routes in the README and are linked from the site's public pages, but the new live loop omits both. The existing contract tests do not close this gap: tests/pages.test.mjs derives PAGES from the files that still exist, so deleting one of these pages merely shrinks the test set. That leaves the stated "every public route" acceptance contract incomplete for the site's legal surface.

Closure checklist:

• Add an explicit pre-deploy existence assertion for /imprint.html and /privacy.html that cannot shrink when either file is deleted.
• Add /imprint.html and /privacy.html to the post-deploy live route loop.

[TueJon]

Fixed the legal-route deploy coverage class in 19616d4: the test job now explicitly asserts imprint.html and privacy.html exist, and the live deploy loop verifies both URLs. Verification: 53/53 Node contract tests pass; workflow diff passes git diff --check.

[TueJon]

No blocking findings. The fix closes both items from the prior review: the test job now has non-shrinking existence assertions for both legal files, and the live deploy loop checks both legal URLs.

The fix commit changes only that workflow coverage, git diff --check passes, and the exact-head test job is green.