ci: gate deploy on link check, add pytest workflow, and harden permissions

[shunk031]

Summary

• Gate deploy on link check: deploy now needs: [build, check-broken-links] in gh-pages.yml, so a broken-link failure blocks the gh-pages publish instead of racing it (previously check-broken-links and deploy both only depended on build and ran in parallel with no ordering guarantee).
• Harden permissions: added top-level permissions: contents: read to gh-pages.yml. Deploy uses the ACTIONS_DEPLOY_KEY deploy_key secret, not GITHUB_TOKEN, so no write scope is required.
• Job-level skip for PRs: moved the (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main' condition from the Deploy step's if: up to the deploy job's if:. Previously PR runs still executed the whole deploy job (downloading the artifact) only to skip the final step as a no-op; now the entire job is skipped on PRs.
• Bump lychee and single-source its version: v0.21.0 → v0.24.2 (latest stable, per gh api repos/lycheeverse/lychee/releases/latest). The version is pinned once in mise.toml (lychee = "0.24.2", was "latest"), and both gh-pages.yml and lychee-prune.yml read it from mise.toml at runtime (tomllib one-liner → step output → lycheeVersion:) instead of hardcoding it per workflow, so there is no duplicate version management. In lychee-prune.yml the version is read right after checkout, before the prune-branch step switches branches.
• Add test workflow: new .github/workflows/test.yml (workflow name Test, job test) runs tests/ via uv run --with pytest --with ruamel.yaml pytest tests/ -q using astral-sh/setup-uv@v8.3.2 (latest release), triggered on pull_request and push to main, scoped with paths: to tests/**, scripts/**, .agents/skills/**, and the workflow file itself (.github/workflows/test.yml) so changes to the workflow are also CI-verified before merge. permissions: contents: read only.
• Fix Hugo timeout: config/_default/hugo.yaml's bare timeout: 600000 changed to timeout: "600s". This is a behavioral change, not just a notation cleanup: Hugo v0.136.5 interprets the bare number 600000 as seconds, so the effective timeout was ~166 hours. The original 600000 appears to be a leftover from Hugo's old milliseconds interpretation (600000 ms = 10 min), so "600s" restores the originally intended 10-minute timeout unambiguously.

Test plan

• Parsed all changed/added YAML (gh-pages.yml, lychee-prune.yml, test.yml, hugo.yaml) and mise.toml with yaml.safe_load / tomllib.load — all valid.
• Verified the mise.toml version-extraction one-liner locally: prints v0.24.2.
• uv run --with pytest --with ruamel.yaml pytest tests/ -q → 18 passed.
• mise exec -- hugo --gc --minify → builds successfully (821 pages) with the new timeout: "600s".
• actionlint run over all workflow files (via mise exec actionlint@latest) → no findings, exit code 0.

🤖 Generated with Claude Code

[shunk031]

mise.toml と連携できたりします？二重管理キツイ気がして

[shunk031]

pytest ってより test みたいな一般的な感じにしたいです