CI: guard against reading data-lectures over the LFS media host

A dataset URL on the wrong host fails in the reader's notebook, not in CI.
media.githubusercontent.com is the LFS *media* endpoint and routes per path,
serving a file only where that path is LFS-tracked in the repo the URL names.
Everything data-lectures publishes is plain git, so that host never resolves
for it — and the datasets folded in from high_dim_data are read from it
today, which means a mechanical org/repo swap that preserves the host breaks
every one of them.

Nothing in this repo would catch that. The data-audit dashboard that does
lives in QuantEcon/data-lectures and never runs on a pull request here — its
detection lag is up to seven days. This runs pre-merge, in the repo being
changed, and `grep -r` also walks lectures/_static/**/*.ipynb, which the
audit deliberately does not scan and this repo's build never executes.

Matches zero lines today (verified: exit 1), so it goes green on merge and is
armed before the fold rather than alongside it.

Gate 2 of QuantEcon/workspace-lectures#23 step 3. See QuantEcon/data-lectures
PLAN.md, repoint rule 6.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mmcky

.github/workflows/data-url-guard.yml

@@ -0,0 +1,36 @@
+# A dataset read that points at the wrong host fails in the reader's notebook,
+# not in CI. The data-audit dashboard that would catch it lives in
+# QuantEcon/data-lectures, runs on that repo's pushes and a weekly cron, and
+# never on a pull request here — so its detection lag is up to seven days.
+# This is the only check that fires at the moment of the change.
+#
+# See QuantEcon/data-lectures PLAN.md, repoint rule 6.
+
+name: Data URL guard
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  data-url-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: No data-lectures read on the LFS media host
+        run: |
+          # media.githubusercontent.com is the LFS *media* endpoint and routes
+          # per path: it serves a file only where that path is LFS-tracked in
+          # the repo the URL names, and 404s otherwise. Everything data-lectures
+          # publishes is plain git, so this host never resolves for it — and a
+          # mechanical org/repo swap that preserves the host breaks every read.
+          #
+          # grep -r walks lectures/_static/**/*.ipynb, which the data-lectures
+          # audit deliberately does not scan and this repo's build never
+          # executes (lectures/_config.yml, exclude_patterns).
+          if grep -rnF 'media.githubusercontent.com/media/QuantEcon/data-lectures' lectures/; then
+            echo "::error::Read data-lectures over raw.githubusercontent.com (or the github.com/.../raw/ redirect), never media.githubusercontent.com — that host is LFS-only and 404s every file data-lectures publishes."
+            exit 1
+          fi
+          echo "OK — no data-lectures read on the media host."