ci: score every pull request, publish every commit to main

Two jobs, because they answer different questions.

A pull request wants a number and a direction. It scores the merged result and the base it sits on, and prints both with the movement between them, plus the rules that actually took something off. It needs no credentials and publishes nothing, so it works from a fork.

A push to main wants the commit browsable. explorer.deka.gg reads its data from a bucket at request time, so a commit appears as soon as this uploads it — nothing rebuilds and nothing deploys. A dataset names its commit and describes nothing else, which makes it immutable: the job takes down the four the bucket already has and analyses only the one that is new.

ci: score every pull request, publish every commit to main

Two jobs, because they answer different questions.

A pull request wants a number and a direction. It scores the merged result and the base it sits on, and prints both with the movement between them, plus the rules that actually took something off. It needs no credentials and publishes nothing, so it works from a fork.

A push to main wants the commit browsable. explorer.deka.gg reads its data from a bucket at request time, so a commit appears as soon as this uploads it — nothing rebuilds and nothing deploys. A dataset names its commit and describes nothing else, which makes it immutable: the job takes down the four the bucket already has and analyses only the one that is new.

Merge pull request #1156 from dekaruntime/claude/lockstep-check-1154

ci: enforce lockstep pins against deka's own version (deka#1154)

Merge remote-tracking branch 'origin/main' into claude/lockstep-check-1154

Merge pull request #1157 from dekaruntime/claude/lockstep-0.53.7

Lockstep: pin dsc 0.53.7-canary-f1c935f and corpus-v0.53.7 (rfd#59)

Merge pull request #300 from dekaruntime/claude/lockstep-check-293

ci: enforce lockstep pins against dsc's own version (dsc#293)

ci: quote the lockstep test command (trailing :: broke YAML)

chore: lockstep pins dsc 0.53.7-canary-f1c935f and corpus-v0.53.7 (rfd#59)

ci: enforce lockstep pins against deka's own version (deka#1154)

rfd#68's 2026-09-17 amendment to rfd#59: deka, dsc, testsuite and tour share one version. Add scripts/lockstep-check.sh (pure decision logic, hermetically tested by tests/lockstep-check.sh) and scripts/lockstep-verify.sh, the CI gate that reads deka's workspace Cargo.toml version and fails unless scripts/dsc-version and scripts/testsuite-corpus-version carry that base version (a -canary- suffix is fine), or the immediately previous released version (highest stable vX.Y.Z tag below current) while a bump is mid-flight. Wired into ci.yml as its own fast job, bash only, no Rust build.

closes#1154

ci: enforce lockstep pins against dsc's own version (dsc#293)

rfd#68's 2026-09-17 amendment to rfd#59: deka, dsc, testsuite and tour share one version. Add cargo xtask check-lockstep, which reads dsc's workspace Cargo.toml version and fails unless scripts/deka-runtime-version and scripts/testsuite-corpus-version carry that base version (a -canary- suffix is fine), or the immediately previous released version (highest stable vX.Y.Z tag below current) while a bump is mid-flight. Wired into CI as its own fast job that doesn't build the workspace.

closes#293