Deploy can ship while Checks is failing

Problem

deploy.yml and checks.yml both trigger on push to main and run in parallel with no
dependency between them. Deploy runs npm ci && npm run build and nothing else — no
typecheck, no tests. So a commit that fails the test suite still deploys, and the smoke test
that follows only asserts what the site serves, not what the code means.

That was survivable while every invariant was enforced inside build(). It is less so now:
the agreement between questions.json and the generated client schema module is asserted
only in the test suite, which deploy does not run.

Proposed Solution

Two shapes, either acceptable:

1. Make deploy depend on checks — needs: a shared job, or trigger deploy on
   workflow_run completion of Checks with a success condition.
2. Run typecheck and test inside deploy before the build step.

The first is better: it keeps one definition of what "green" means, and does not double the
runtime of the check suite on every push. The second is simpler and has no cross-workflow
plumbing.

Acceptance Criteria

1. A push to main whose tests fail does not reach production.
2. The failure names the check that failed rather than surfacing as a deploy error.
3. A green push still deploys without a manual step.
4. Deploy's existing behaviour is otherwise unchanged — the propagation poll and smoke test
   still run against the custom domain (#53, #64).

Notes

Found during the review of #73. Not urgent — there is no evidence this has bitten yet — but
it is the kind of gap that is invisible until the day it matters, and the deploy is the only
automated check that runs against production.

Read deploy.yml and checks.yml first, then trace their push-to-main triggers and the existing npm ci, build, propagation poll, and smoke-test steps. Make deploy wait for a successful check result, or run the specified checks before building; verify failed tests block production with a named failure, while a green push still deploys and retains the existing production checks.