publish-health-checklisted

# Publish health check Notices, without anyone manually querying the Actions API, when a Skillz Forge publish silently stops going live. ## Why this exists `.github/workflows/deploy-pages.yml` once failed on every push for months after a monorepo migration, and nobody noticed: pushes to `main` looked normal, but the live site quietly served a stale build. There was no signal that surfaced the failure without an agent deliberately going and checking. This check closes that gap two ways at once: 1. It re-checks the *last* `deploy-pages.yml` run's conclusion for `main`, so a failed publish is flagged even if nobody is watching the Actions tab. 2. It independently compares the *live* `catalog.json`'s `sourceCommit` against the commit that the last successful deploy run actually built (its `head_sha`) -- not against `main`'s current tip, since `deploy-pages.yml` only fires on a `push.paths` allowlist and plenty of legitimate `main` commits (docs, unrelated workflows) never trigger a deploy at all. A mismatch here means a run reported "success" but didn't actually ship the commit it built (a stale Pages cache, a mis-scoped artifact, etc.) -- reporting success is not the same as being live. ## Running it ```bash node .agents/skills/publish-health-check/run.mjs node .agents/skills/publish-health-check/run.mjs --json validation-reports/publish-health-check.json ``` No credentials are required -- it only issues public, unauthenticated `fetch` calls again