Render on PRs before merging, and drop the figure from Projects

[zorian15]

Two changes. The CI one is the substance; the figure removal rode along.

Render on PRs

publish.yml only triggered on push to main, so nothing verified a change until it was already live on the site. Now:

• pull_request trigger added. The build job runs on every PR, so a render failure blocks the merge instead of breaking production.
• deploy is gated on github.event_name != 'pull_request'. PRs build and check; they never publish.
• Pages credentials moved to the deploy job. pages: write / id-token: write were workflow-wide, which meant PR runs held publish permissions they had no use for.
• Concurrency scoped per-ref (pages-${{ github.ref }}), so a PR check can't queue behind a deploy of main. Superseded PR pushes cancel themselves; deploys never do.

This extends the existing workflow rather than adding a second one. A separate PR-only workflow would duplicate the build steps, and the two would drift — the moment a setup-python step gets added for executable blog posts, a duplicated check would stop representing what actually deploys.

Two checks on the rendered output

quarto render exits 0 for plenty of broken-but-valid sites, so the render alone isn't much of a gate. Both scripts live in .github/scripts/ so they can be run locally against a _site too.

check-site.sh asserts the things that have actually gone wrong in this repo:

• every page linked from the navbar exists
• _site/software.html still emits its redirect stub — that comes from one aliases: line in projects.qmd, and deleting it renders fine while silently 404ing every existing link to the old Software page
• required assets ship (cv.pdf, the figure, the profile photo)
• cv.html hasn't regressed to raw.githubusercontent, which serves PDFs as application/octet-stream with nosniff and renders the inline embed as a blank box

check-links.py resolves every internal href/src in the rendered HTML against disk. The usual way to break a content site is a link, not a render error — a .qmd extension that should have been .html, a renamed page, an image moved out of files/. Quarto renders all of those without complaint. External URLs are not checked.

Figure removed from Projects

Figures belong on the publications page; the projects page is text-only. The SVG is unchanged and still used as the 2026 entry's thumbnail.

Verification

Rendered locally with Quarto 1.10.18 from a clean _site. Both checks pass (152 internal links across 7 pages, no breaks). I also confirmed they fail correctly — a check that can't fail is worthless — by deleting projects.html, deleting the software.html redirect, pointing cv.html back at raw.githubusercontent, and rewriting a link to ./projects.qmd. Each exits 1 with the specific reason.

The real test is this PR: build should run and deploy should be skipped.

🤖 Generated with Claude Code

https://claude.ai/code/session_011mFiYv4seQ8Hyar7anXMFR