ci: publish to pages from a pre-push hook

Pushing main now rebuilds the site and force-pushes dist/ to pages.

.agents/scripts/publish-pages.sh does the work. It never checks pages
out: it writes a tree straight from dist/ with write-tree and
commit-tree, so the working tree is untouched and a failure halfway
through leaves nothing behind. The commit is parented on the current
pages tip, so the branch keeps its history and a rollback is one
force-push to an earlier commit -- which the script prints before it
pushes.

It refuses to publish when the working tree is dirty, when HEAD is not
main, when HEAD is not the commit being pushed, or when any of the ten
routes is missing or empty in dist/. A build can succeed and still emit a
stub; that is exactly how this site would go down.

The hook guards three ways. AF_PUBLISHING short-circuits it so the
publisher's own push does not re-enter it forever. AF_NO_PUBLISH=1 lets
you push main without publishing. And because git has no post-push hook,
the publish necessarily runs before main lands -- so it first checks that
the remote tip is an ancestor of what is being pushed, and skips
publishing when the push could still be rejected as a non-fast-forward.

Also rewrites the operations guide's rollback section, which still
described merging main into pages with --ff-only. That has not been true
since pages started carrying build output.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

AGENTS.md

@@ -41,8 +41,14 @@ that pin the site's real content and interactions, read from the built output.
 
 `main` is the source of truth. The `pages` branch is what the Gitea Pages Server
 actually serves, and it now carries **build output**, not a copy of `main`'s
-tree. The publish job force-pushes `dist/` over it. The full procedure is in
-[`docs/operations-guide.md`](docs/operations-guide.md); read
+tree.
+
+**Pushing `main` republishes the live site.** The `pre-push` hook runs the gate,
+then `.agents/scripts/publish-pages.sh`, which builds and force-pushes `dist/`
+to `pages`. Use `AF_NO_PUBLISH=1 git push` to land a commit without publishing.
+`pages` keeps its history, so rollback is a single force-push to an earlier tip;
+`pages-backup-2026-09-06` is the last commit of the hand-written site. The full
+procedure is in [`docs/operations-guide.md`](docs/operations-guide.md); read
 [`.agents/context/publishing.md`](.agents/context/publishing.md) before changing
 it.