fix(ci): keep the freshness signal alive and the push resilient

`lastConfirmedAt` lives in gitignored bookkeeping that only refresh.yml
restored, so the workflow that actually builds and deploys never saw it:
every source reported its last *content change* as its last success, and
the UI flagged anything whose bytes had not moved in two days as stale —
which is most wiki pages most of the time. ci.yml now restores the same
cache read-only before building the feed.

The refresh push was a bare `git push`, so a human push landing in
between made it non-fast-forward: the job failed and threw away pages it
had just fetched, while the bookkeeping had already been saved, so those
sources would not be re-asked for six hours. Rebase and retry instead —
never force.

The cache save key used run_id, which is stable across re-runs, so a
re-run saved nothing and the run after it restored stale bookkeeping.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

.github/workflows/ci.yml

@@ -28,6 +28,20 @@ jobs:
 
       - run: bun install --frozen-lockfile
 
+      # `lastConfirmedAt` — the "we asked the wiki and it said this is still
+      # current" half of the freshness badge — lives in the gitignored
+      # snapshots/*.state.json, so without this the feed built here has only
+      # `contentChangedAt` to go on and every source reads as stale two days
+      # after its bytes last moved, which for a wiki page is most of the time.
+      # Restore-only: refresh.yml owns writing this cache, and a miss just
+      # returns the pre-existing fallback behaviour.
+      - name: Restore refresh bookkeeping
+        uses: actions/cache/restore@v4
+        with:
+          path: snapshots/*.state.json
+          key: refresh-state-
+          restore-keys: refresh-state-
+
       - name: Typecheck
         run: bun run typecheck
 
@@ -65,6 +79,16 @@ jobs:
         with:
           bun-version: "1.3"
       - run: bun install --frozen-lockfile
+
+      # This is the job whose output is deployed, so this is the one that must
+      # see the refresh bookkeeping; see the same step in `check`.
+      - name: Restore refresh bookkeeping
+        uses: actions/cache/restore@v4
+        with:
+          path: snapshots/*.state.json
+          key: refresh-state-
+          restore-keys: refresh-state-
+
       - name: Build
         # Pages serves from /<repo>/, so the app is built with a matching base
         # href. Built at the domain root it would 404 on every asset.