CI: add scheduled link verification (muffet) against production wafer.space

[mithro]

Problem

Link verification (muffet, in .github/workflows/preview-verification.yml) only runs on pull requests, never against the deployed main site. As a result, broken links can rot in production indefinitely without any CI signal.

Why this happens

• preview-verification.yml (the muffet check) triggers only on:

  on:
    pull_request:
      branches: ["main"]
      types: [opened, synchronize, reopened]
    workflow_dispatch:

• jekyll.yml is what actually runs on push to main (the GitHub Pages deploy) and contains zero link verification (grep -c muffet jekyll.yml → 0).
• muffet therefore only ever scans the per-PR preview (preview.wafer.space/pr-NN/) using the links present on the branch at PR time.

Consequence

A link that is valid at merge time but later goes 404/403/times out is never re-checked. These failures accumulate silently on main. This was made visible while working on PR #93: merging main into the branch aggregated all news-post content into one muffet scan, surfacing ~15 broken/flaky links (genuine 404s, bot-blocked domains, and a --baseurl bug) that main's own CI had never reported.

Proposed solution

Add a scheduled (cron) muffet run against the live production site (https://wafer.space), reporting failures (e.g. open/update an issue, or fail a dedicated job) so post-merge link rot is caught.

Sketch:

on:
  schedule:
    - cron: "0 6 * * 1"   # weekly, Monday 06:00 UTC
  workflow_dispatch:

…running the same muffet invocation (and shared --exclude list) currently used in preview-verification.yml, but pointed at https://wafer.space instead of the preview URL.

Considerations

• Share the exclude list. The production check should reuse the same --exclude patterns (mailto:, linkedin.com, hawaii.edu, timeanddate.com, mabrains.com, matrix.to, …) so the two checks don't drift. This is a natural fit with Move the website verification into it's own reusable GitHub Action #6 (move verification into a reusable action) — a shared action would let PR-time and scheduled runs share one definition.
• Depends on --baseurl correctness (Fix everything so that it works with Jekyll --baseurl #8). One of the failures found on PR Add direct # anchor links to all headings on index pages #93 was a baseurl bug (preview.wafer.space/news/chip-on-board-strategy 404). A production checker needs correct baseurl handling to avoid its own false positives.
• Reporting strategy is a design choice. Options: fail the scheduled job (shows in the Actions tab), open/update a tracking issue on failure, or post to a chat channel. Failing silently in a cron job that nobody watches should be avoided.

Acceptance criteria

• A scheduled workflow runs muffet against https://wafer.space on a regular cadence (and via workflow_dispatch).
• It reuses the same exclude list as the PR-time check (no drift).
• Failures are surfaced somewhere a human will see them (not just a silent red cron run).