Checkout the live deployment verifier

[erinepshovel-code]

Purpose

Repairs the one production-wiring defect found by the first post-merge Pages run from commit 9d750bdd5aacfb0b695ab979f7e8c5bc00e56971.

The build, canon gates, tests, Chromium checks, accessibility checks, artifact verification, upload, and Pages deployment all succeeded. The deploy job then failed because it attempted to run scripts/verify-live-deployment.mjs without checking out the repository in that separate runner.

Change

Path	Change	Purpose	Risk	Required evidence
.github/workflows/pages.yml	add pinned checkout step to deploy job	make the already-merged live identity verifier available after Pages deployment	minimal; deploy runner gains read-only repository content	PR workflow green, workflow audit green, next Pages run reaches both identity checks

The added checkout uses the same approved full commit SHA already permitted by the repository workflow audit.

Observed production evidence

Pages run 29817468618:

• Build verified site — passed
• browser/accessibility release checks — passed
• artifact identity — passed
• Pages deployment — passed
• verification script invocation — failed with MODULE_NOT_FOUND

hmmm

No platform setting is changed by this PR. Issue #8 remains the boundary for Pages source, DNS, HTTPS, environment policy, and branch protection if the corrected live checks expose any such mismatch.