Add deterministic Render deploy hook after verified publication

[erinepshovel-code]

Repair

Render's native commit autodeploy is not firing because the connected service is effectively a public-repository service without a usable Git provider event credential.

This adds the supported deterministic fallback:

1. Pages build/test/browser/a11y passes.
2. GitHub Pages deploys and verifies the exact commit.
3. On a real push to main, GitHub POSTs the secret Render deploy hook.
4. If the secret is absent, the workflow emits an explicit hmmm warning rather than claiming deployment.

Secret name: RENDER_DEPLOY_HOOK_URL.

The workflow does not run the Render trigger for schedules, repository_dispatch refreshes, or PR builds.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-23T15:49:21.560051Z	c01e650	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.