Fix GitHub Pages deployment race

The automatic pages-build-deployment workflow (Jekyll) runs on every
push to main and renders README.md as the site. It was finishing after
our WASM deployment, overwriting it. The live site showed README
content instead of the WebAssembly demo.

Changes to deploy-pages job:
- Wait for the automatic Jekyll build to complete before deploying,
  polling by commit SHA to target only the run from this push
- Add .nojekyll to the deployed artifact to suppress Jekyll processing
- Add actions:read permission required by gh run list

Author: jserv

.github/workflows/main.yml

@@ -100,7 +100,7 @@ jobs:
         continue-on-error: true
       - name: Upload test artifacts
         if: failure()
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: test-screenshots
           path: build/*.png
@@ -171,7 +171,7 @@ jobs:
       - name: Prepare deployment
         run: .ci/build-wasm.sh deploy-prep
       - name: Upload WASM artifacts
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
         with:
           name: wasm-build
           path: deploy/
@@ -183,17 +183,49 @@ jobs:
     timeout-minutes: 10
     runs-on: ubuntu-24.04
     permissions:
+      actions: read
       contents: read
       pages: write
       id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
+      - name: Wait for automatic Pages build
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          # The automatic pages-build-deployment workflow (Jekyll) runs on
+          # every push and renders README.md. Wait for it to finish so our
+          # WASM deployment is always the final one.
+          #
+          # Filter by commit SHA to wait only for the run from this push.
+          sleep 10
+          for i in $(seq 1 30); do
+            RUNNING=$(gh run list -R "${{ github.repository }}" \
+              --workflow=pages-build-deployment \
+              --commit "${{ github.sha }}" \
+              --json status \
+              --jq '[.[] | select(.status != "completed")] | length' \
+              2>/dev/null) || RUNNING="error"
+            if [ "$RUNNING" = "error" ]; then
+              echo "Could not query pages-build-deployment (may be disabled)"
+              break
+            fi
+            if [ "$RUNNING" = "0" ]; then
+              echo "No competing Pages deployment running for this commit"
+              break
+            fi
+            echo "Waiting for automatic Pages build... (${i}/30)"
+            sleep 5
+          done
       - uses: actions/download-artifact@v6
         with:
           name: wasm-build
           path: deploy/
+      - name: Disable Jekyll processing
+        run: touch deploy/.nojekyll
       - uses: actions/configure-pages@v5
       - uses: actions/upload-pages-artifact@v3
         with: