Deploy web/ to GitHub Pages; point hosted visitors at self-hosting

The Pages workflow uploads web/ with no build step, so the served files
are auditable against the repo tree at the deployed commit. The footer
now tells visitors of any hosted copy to clone and serve locally.

Author: John Gribbin

.github/workflows/pages.yml

@@ -0,0 +1,35 @@
+# Deploys web/ to GitHub Pages, unmodified — no build step, so the served
+# files are byte-identical to the repo tree at the deployed commit and can
+# be audited against it (see TRUST.md).
+name: Deploy webapp to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/configure-pages@v5
+        with:
+          enablement: true
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: web
+      - id: deployment
+        uses: actions/deploy-pages@v4

web/index.html

@@ -172,8 +172,11 @@ <h2>Verify the sources yourself</h2>
     </table>
   </section>
 
-  <footer>Serve this directory locally to open the page: <code>python3 -m http.server</code> in <code>web/</code>, then
-  visit <code>http://localhost:8000</code>. Browsers cannot load the WebAssembly runtime from <code>file://</code>.
+  <footer>Viewing a hosted copy of this page? Don't trust it — clone
+  <a href="https://github.com/johngribbin/dice-rolls">the repo</a>, audit it, and serve it yourself, offline:
+  <code>python3 -m http.server</code> in <code>web/</code>, then visit <code>http://localhost:8000</code>
+  (browsers cannot load the WebAssembly runtime from <code>file://</code>). The GitHub Pages deploy is built from
+  the repo with no build step, so its files can be audited against the tree at the deployed commit.
   BitBox02/Jade use a paper lookup table — no comparable algorithm.</footer>
 </main>