ci(dependabot): require successful Pages PR checks

[jrandolf]

Root cause

Dependabot #143 at addbc164863be1a8e0934099ecb31af4836403b5 has a successful Build Pages check but a skipped deploy check. The existing strict gate succeeded because it exempted that skipped check. A skipped applicable check must not be accepted for dependency auto-merge.

Repair

• .github/workflows/pages.yml: keep the release-only Pages deployment on main, without creating a skipped deploy check on PRs.
• .github/workflows/pages-check.yml: run the same Pages build and artifact validation on PRs; retain the Build Pages check.
• .github/workflows/dependabot-automerge.yml: require every observed exact-head check to succeed and fix the jq grouping so it evaluates the check-run array, not a boolean.

Commit: ci(dependabot): require successful Pages PR checks (28946e201f643fde22e94428785a78dea0619b2e). No release or check bypass.

Local validation

All commands exited 0 in an isolated clone, using external-drive storage at /Volumes/Code/Sources/.dev-storage/mathematic-inc-monitor/2026-09-26T1500Z-full.Hca07d:

Command	Log
mise install	logs/ts-japi-mise-install.log
pnpm install --frozen-lockfile	logs/ts-japi-pnpm-install.log
hk check --all --slow	logs/ts-japi-hk-full.log
pnpm typecheck	logs/ts-japi-typecheck.log
pnpm build	logs/ts-japi-build.log
pnpm test	logs/ts-japi-test.log
pnpm pack --dry-run	logs/ts-japi-pnpm-pack-dryrun.log
pnpm audit --audit-level high	logs/ts-japi-audit.log
mise exec node@20.0.0 -- node --input-type=module -e "const api = (await import('./lib/index.js')).default; const document = await new api.Serializer('users').serialize({ id: '1', name: 'Ada' }); if (document.data?.type !== 'users' \|\| document.data?.id !== '1') process.exit(1);"	logs/ts-japi-node20-runtime.log
mise exec node@20.0.0 -- npm pack --dry-run	logs/ts-japi-node20-npm-pack-dryrun.log
actionlint on the three changed workflows	logs/ts-japi-actionlint.log

The gate's jq filter was tested against the live #143 check-run payload: a skipped deploy returned false; changing only that conclusion to success returned true. The PR must still pass every exact-head check and repository rule before merging.