chore: Publish the README to GitHub Pages with Jekyll

[hexember]

Stacked on #29. Merge order: #29 first, then this PR (GitHub retargets it to main when #29 merges).

Summary

Add a first-party GitHub Actions workflow that builds README.md (as index.html) and the four root docs it links to with Jekyll, then deploys them to https://hexember.github.io/active-browser/ on every relevant push to main. No repository settings change.

Why: the live site is stale. It still advertises an install one-liner on a domain this project does not own, and it still serves an old copy of /install.sh. Nothing rebuilds it today. Once this stack merges, the site is rebuilt from the README, and the only install command is the raw.githubusercontent.com one-liner.

Published set (enforced by _config.yml and a post-build allowlist check): README.md → /, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, CHANGELOG → .html, plus the theme's CSS. install.sh, LICENSE, Project.md, CLAUDE.md, tasks/, docs/, assets/, Sources/, Support/, Makefile and Package.swift are not published.

Spec checklist

• .github/workflows/pages.yml (new): actions/*@vN only (checkout@v4, configure-pages@v6, jekyll-build-pages@v1, upload-pages-artifact@v5, deploy-pages@v5). Top-level permissions: {} with per-job scopes. Triggers are push to main (7 paths), pull_request (same paths, no branch filter) and workflow_dispatch. There is an allowlist step between build and upload. deploy is gated to non-PR events and has job-level concurrency: { group: pages, cancel-in-progress: false }. No Gemfile.
• _config.yml (new): Cayman theme, repository: hexember/active-browser, show_downloads: false, readme_index / optional_front_matter with remove_originals: true, include: limited to CONTRIBUTING.md and CODE_OF_CONDUCT.md, and a block-list exclude:.
• Project.md: §3 split-table row 18, a Phase 6 bullet about the site, and §4 tree entries for _config.yml and pages.yml.
• CONTRIBUTING.md: repository layout block updated, plus a paragraph on site link rules. No heading changed.
• CHANGELOG.md: one ### Fixed bullet about the outdated website install command. The old domain is not spelled.
• Amendment A1 (include: + remove_originals) and A2 (build on PRs, deploy only from main, job-level concurrency).

Self-verification (ai steps, run 2026-09-23)

#	Check	Actual	Result
1	Local github-pages Jekyll present?	none (ruby/bundle via rbenv only); the real build is proven by step 10b	pass
2	YAML parse + key audit of _config.yml and pages.yml	all keys/values as specified; push/pull_request paths equal true	pass
3	Jekyll source-filter simulation (+ negative run)	(a) exactly the 5 docs, problems: 0, exit 0. (b) both blacklist lines, include line, both remove_originals lines, problems: 5, exit 1	pass
4	Old domain absent from published docs and _config.yml	no matches, exit 1; info grep of Project.md / .github/ also empty	pass
5	No Liquid tags in published docs	no matches, exit 1	pass
6	Actions audit	5 uses:, all actions/*@vN; cancel-in-progress count 1; install.sh only in header comment; no Gemfile(s)	pass
7	Allowlist-step dry run (4 runs)	run1 exit 0 + VoG warning; run2 exit 1 names install.sh; run3 exit 1 old domain; run4 (live-site shape) exit 1, five .md listed, CONTRIBUTING/CODE_OF_CONDUCT .html missing	pass
8	Baseline of the live stale site	old-domain count 2, /install.sh returns 200 (the problem this PR fixes)	recorded
9	swift build	no warnings/errors; Build complete!	pass
10	Diff scope vs chore/readme-restructure	only the 6 task files; CHANGELOG no removed lines; CONTRIBUTING headings identical	pass
10b	PR-time pages run: build green, deploy skipped, artifact contents	pending. This runs on this PR's pull_request workflow run, and the result will be posted as a PR comment.	pending

Testing notes

Preconditions

• Nothing to build or install locally.
• Merge docs: Restructure README for users; move contributor material to CONTRIBUTING #29 first, then confirm this PR retargets to main.
• Step 10b (the PR-time Jekyll build) must show green before this PR is merged. Its result will be posted as a comment on this PR.

#	Action	Expected
11	Merge PR #29 first, confirm this PR retargets to main, then merge this PR. Open Actions → pages → the run for the merge commit.	The pages run is green: build passes, including "Published set is exactly the allowlist", and deploy shows the github-pages environment URL. Any ::warning:: about "View on GitHub" is noted.
12	About 2 minutes after the deploy, open https://hexember.github.io/active-browser/ in a browser, hard-refreshed.	It shows the current README: the Contents line, and Install showing the raw.githubusercontent.com/hexember/active-browser/main/install.sh one-liner. The Cayman header reads "ActiveBrowser" with the tagline and has a View on GitHub button to github.com/hexember/active-browser. There are no Download .zip/.tar.gz buttons, and the H1 is not repeated under the header.
13	curl -s https://hexember.github.io/active-browser/ | grep -c 'activebrowser\.app', and for each of install.sh, Project.html, CLAUDE.html, tasks/TEST-PLAN.html, LICENSE, Makefile, README.html: curl -s -o /dev/null -w '%{http_code} %{url_effective}\n' https://hexember.github.io/active-browser/<path>	The count is 0. Every path returns 404 (README.html 404 is expected; README is served at /).
14	On the site, click README's links to CONTRIBUTING.md, SECURITY.md, Code of Conduct and CHANGELOG.md. Then, on the SECURITY page, click README.md → Privacy. Also click the in-page Contents links.	Each opens the rendered .html page on hexember.github.io, not a 404 or a raw .md file. #build-and-run, #what-youre-trusting-when-you-install-this and #privacy land on the right heading. Contents anchors scroll correctly. LICENSE links open GitHub.

Reset after testing

• None. The Pages deployment is the intended permanent change. To roll back, revert this PR's merge. The site then stays frozen at its last deploy until a pages run happens, so a revert alone does not restore the old site, and it shouldn't.

🤖 Generated with Claude Code

[hexember]

ai step 10b: pass. The PR-time Jekyll build (run 35777705333) succeeded. build: success, and the allowlist check passed. deploy: skipped, as it should be on a PR. The github-pages artifact holds exactly index.html, CONTRIBUTING.html, SECURITY.html, CODE_OF_CONDUCT.html, CHANGELOG.html and assets/css/style.css. There are no raw .md files and no install.sh, the old install domain doesn't appear anywhere, and every relative link was rewritten to .html. The index has the View on GitHub button and shows the raw.githubusercontent install one-liner.