docs: add deployment and maintainer workflow

.env.example

@@ -0,0 +1,2 @@
+SITE=https://wiki.example.org
+BASE=/

.github/workflows/deploy.yml

@@ -0,0 +1,38 @@
+# Optional GitHub-mirror deployment. Forgejo ignores this GitHub-specific
+# workflow, and the repository does not rely on it for validation or deployment.
+name: Deploy to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the mirror
+        uses: actions/checkout@v7
+      - name: Build and upload the Pages artifact
+        uses: withastro/action@v6
+        with:
+          node-version: 22.22.3
+        env:
+          SITE: ${{ vars.SITE_URL }}
+          BASE: ${{ vars.BASE_PATH }}
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v5

README.md

@@ -0,0 +1,73 @@
+# Incognito Wiki
+
+This repository contains the public Incognito student wiki, built as a static site with Astro and Starlight. Forgejo hosts the authoritative private repository. Local commands are the source of truth: the project does not depend on Forgejo CI.
+
+## Local development
+
+Use Node.js 22.12 or newer and the npm version bundled with Node. Hosted builds are pinned to Node.js 22.22.3. Install dependencies from `package.json` with:
+
+```sh
+npm install
+```
+
+Use the checked-in lockfile for a reproducible clean install with `npm ci`.
+
+- `npm run dev` starts the local development server.
+- `npm run check` runs Astro validation and the Node test suite.
+- `npm run verify` runs all checks, the content audit, a production build, and the internal-link check.
+
+## Maintaining content
+
+Published pages live in `src/content/docs/`. Add or edit Markdown and MDX there. Navigation is explicit, so add, remove, or move the matching entry manually in `src/config/sidebar.mjs` whenever a published page changes.
+
+Use these notice conventions exactly for migrated source material:
+
+Historical or potentially outdated information:
+
+```md
+:::caution[Historical information]
+This information originated in the previous wiki and may be outdated.
+:::
+```
+
+An intentionally empty page:
+
+```md
+:::note[Awaiting content]
+This page is awaiting content.
+:::
+```
+
+A source asset that was referenced but not exported (replace the identifier only):
+
+```md
+:::danger[Missing source asset]
+The previous wiki referenced `source:asset-name.ext`, but that file was not included in the export.
+:::
+```
+
+The `to-be-studied/` directory is research material, not publication content. Never move it or its contents into `src/content/docs/` or `public/` without a separate editorial review.
+
+## Reviewing the migration
+
+Read `docs/migration-report.md` when reviewing migrated content. Its source inventory maps every selected DokuWiki source to its destination and records outdated notices, repaired or removed links, missing assets, and significant copy edits. Review the dedicated summaries after the table for unresolved or time-sensitive material, and update the relevant row and summary whenever a migration decision changes.
+
+## Deployment
+
+`SITE` is the public origin and `BASE` is the path prefix. They are public build settings, not secrets; `.env.example` documents local defaults. Keep credentials and tokens out of these values and out of the repository.
+
+For a custom domain hosted at its root:
+
+```sh
+SITE=https://wiki.example.org BASE=/ npm run build
+```
+
+For repository-subpath hosting such as GitHub Pages:
+
+```sh
+SITE=https://example.github.io BASE=/Incognito-Wiki npm run build
+```
+
+Netlify reads `netlify.toml`, runs `npm run build`, and publishes `dist`. Configure `SITE` and `BASE` as environment values for the selected production hostname and path.
+
+The removable workflow at `.github/workflows/deploy.yml` optionally deploys the GitHub mirror to Pages after a push to `main` or a manual dispatch. Set the public repository variables `SITE_URL` and `BASE_PATH` on GitHub. The workflow is GitHub-specific; Forgejo ignores it, and removing the workflow or `netlify.toml` does not affect local development or verification.

netlify.toml

@@ -0,0 +1,6 @@
+[build]
+  command = "npm run build"
+  publish = "dist"
+
+[build.environment]
+  NODE_VERSION = "22.22.3"

tests/project-structure.test.mjs

@@ -66,3 +66,25 @@ test('landing page labels source-era programme information as potentially outdat
     /This information originated in the previous wiki and may be outdated\./,
   );
 });
+
+test('Netlify builds the static site into dist', async () => {
+  const config = await readFile('netlify.toml', 'utf8');
+  assert.match(config, /command = "npm run build"/);
+  assert.match(config, /publish = "dist"/);
+});
+
+test('the optional GitHub Pages workflow deploys only main or manual runs', async () => {
+  const workflow = await readFile('.github/workflows/deploy.yml', 'utf8');
+  assert.match(workflow, /push:\s*\n\s+branches: \[main\]/);
+  assert.match(workflow, /workflow_dispatch:/);
+  assert.doesNotMatch(workflow, /pull_request:|schedule:/);
+  assert.match(workflow, /actions\/checkout@v7/);
+  assert.match(workflow, /withastro\/action@v6/);
+  assert.match(workflow, /actions\/deploy-pages@v5/);
+});
+
+test('maintainer documentation keeps Forgejo CI-independent', async () => {
+  const readme = await readFile('README.md', 'utf8');
+  assert.match(readme, /Forgejo[^\n]*authoritative private repository/i);
+  assert.match(readme, /does not depend on Forgejo CI/i);
+});