chore(scripts): harden deploy_webpage.sh with set -euo pipefail

## Summary

`scripts/deploy_webpage.sh` runs under bare `set -e`, while the maintained scripts in the same directory use the stricter `set -euo pipefail`. Unset variables and failures inside pipelines currently pass silently, which can let a broken deploy proceed. This aligns the script with the rest of `scripts/`.

## Background

The webpage deploy script builds the static site and pushes it to the `gh-pages` branch of a separate releases repository. A silent failure here can publish an incomplete or stale site. `set -u` (error on unset variables) and `set -o pipefail` (propagate failures through pipes) catch a class of mistakes that bare `set -e` misses.

## Proposed Solution

Upgrade the script header to `set -euo pipefail`, then read through the script to confirm no expansion relies on an unset variable being empty.

## Implementation Notes

- `scripts/deploy_webpage.sh:6` currently reads `set -e`; change it to `set -euo pipefail`.
- The `REPO_URL` and `BRANCH` assignments at lines 14-15 are unconditional, so they are safe under `set -u`.
- The script uses bare `cd` (line 21 `cd "$WEBPAGE_DIR"`, line 25 `cd out`) rather than a subshell, so the working directory changes persist for the rest of the run. This is not changed by the strictness upgrade, but note it while reading through: any later relative path assumes those directories.
- Validate with `bash -n scripts/deploy_webpage.sh` for syntax and a manual read-through to confirm no unset-variable expansions remain.

## Acceptance Criteria

- [ ] The script runs under `set -euo pipefail`
- [ ] `bash -n scripts/deploy_webpage.sh` passes and a read-through confirms no unset-variable expansions remain

---

## Original Suggestion

### Title: chore(scripts): harden deploy_webpage.sh with set -euo pipefail

`scripts/deploy_webpage.sh` uses bare `set -e` and changes directories without a subshell, unlike the maintained scripts in the same directory which use the stricter `set -euo pipefail`.

## Evidence

- `scripts/deploy_webpage.sh:6` — `set -e` (no `-u`, no `pipefail`)
- `scripts/deploy_webpage.sh:21` (`cd "$WEBPAGE_DIR"`) and `:25` (`cd out`) — bare `cd`s that leave the shell in the build directory for the rest of the script
- Compare `scripts/run_quality_gate.sh:3` — `set -euo pipefail`

## Suggested fix

Upgrade to `set -euo pipefail`, and read through the ~90-line script to confirm the unset-variable strictness does not break anything (the `REPO_URL`/`BRANCH` assignments at lines 14-15 are unconditional, so they are safe).

## Acceptance criteria

- [ ] The script runs under `set -euo pipefail`
- [ ] A dry read-through (or `bash -n`) confirms no unset-variable expansions remain

Open scripts/deploy_webpage.sh at line 6 and read through its roughly 90 lines, checking the REPO_URL and BRANCH assignments and later relative paths after the cd commands. Compare the header with scripts/run_quality_gate.sh, run bash -n scripts/deploy_webpage.sh, and consider the work done when strict mode is used without unset-variable expansions that would break the script.

Written by the indexing model from the issue text.