Reject Clay source failures before publication

[jamiepratt]

Review status

CAUTION: This is an AI-generated CI/publication-policy change. It requires independent review and approval by someone other than the author. Do not merge without that approval.

Summary

• run Clay on Java 21 with a production-like 1 MiB stack
• fail when Clay prints a Clay FAILED marker even if the process exits zero, with GitHub error annotations
• retain a synthetic historical StackOverflowError regression test
• run the complete strict Clay plus Quarto publication gate on pull requests
• deploy only for pushes to upstream main

Separation

The Beta article overflow repair was separated and merged in #417. This PR contains no article source or extracted asset changes; it contains only the five strict-gate workflow, script, test, and documentation files.

Validation

• bash syntax and shellcheck passed
• regression fixture rejects the previous StackOverflowError behavior
• strict Clay passed for the complete site with JAVA_TOOL_OPTIONS=-Xss1m
• Quarto rendered 233/233 pages

Model validation: not applicable; this changes publication infrastructure only.

Generated by AI. Human review required.

[jamiepratt]

AI-authorship/review note: this PR was generated by OpenAI Codex and has not received human approval. Please review before merge.

Negative control against merged commit b0c9217:

• full Clay run reproduced java.lang.StackOverflowError
• strict wrapper returned exit 1
• GitHub annotation emitted: ::error title=Clay source render failed::Clay FAILED: src/language_learning/vocabulary_estimation/math_explanations.clj

Positive control at 9fe3381:

• affected Beta-binomial and shared explanation sources pass under -Xss1m
• full Clay has no failure marker
• Quarto renders 233/233 pages

Highest-value review areas: shell PIPESTATUS propagation, failure-marker matching/annotations, and the classpath resource load.

[jamiepratt]

Follow-up from Codex: commit 64a2614 now runs the full publication build on pull_request and guards the deploy job to pushes on main. The PR therefore gets a blocking pre-merge build check; forced Clay failures appear as GitHub ::error annotations naming each rejected source. Human review is still required.

[jamiepratt]

AI-generated verification report — human review still required before merge.

The gate was exercised against the real failure mode in GitHub Actions:

• First PR run failed: https://github.com/ClojureCivitas/clojurecivitas.github.io/actions/runs/29411223109
• The build emitted a GitHub error annotation for src/language_learning/vocabulary_estimation/beta_binomial_first_pass.clj and logged java.lang.StackOverflowError.
• The deploy job was skipped.
• After moving the large inline article CSS into byte-identical resource files, the rerun passed: https://github.com/ClojureCivitas/clojurecivitas.github.io/actions/runs/29412055884
• On the successful PR run, the strict-gate regression test, full Clay render, and full Quarto render passed; deploy remained skipped because this is a pull request.

Please review the shell failure-detection logic, workflow trigger/deploy guard, and byte-preserving resource extraction rather than treating the green run as approval.

[jamiepratt]

Branch rewritten after separation: ba004c3 is the complete gate-only change. Earlier combined commit SHAs and comments referring to article/resource extraction are superseded; the repair is already merged separately as #417. This PR must remain unmerged until independently reviewed and approved.

[jamiepratt]

Gate-only verification complete: GitHub Actions run 29419194974 passed the build on ba004c3, including the historical failure-detection regression, full strict Clay render, and full Quarto render. The deploy job was skipped as required for a pull request. This is verification, not approval; independent human review is still required before merge.