fix(delivery): deploy directly from protected main

.github/workflows/ci.yml

@@ -1,9 +1,6 @@
 name: Client checks
 
 on:
-  push:
-    branches:
-      - main
   pull_request:
     branches:
       - main

.github/workflows/pages-deploy.yml

@@ -1,24 +1,16 @@
 name: Pages delivery
 
 on:
-  workflow_run:
-    workflows:
-      - Client checks
-    types:
-      - completed
+  push:
+    branches:
+      - main
 
 permissions:
   contents: read
 
 jobs:
   identity:
     name: Resolve exact current-main delivery
-    if: >-
-      github.repository == 'InKCre/client-web' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'main' &&
-      github.event.workflow_run.head_repository.full_name == github.repository
     runs-on: ubuntu-latest
     outputs:
       source_sha: ${{ steps.identity.outputs.source_sha }}
@@ -27,7 +19,7 @@ jobs:
         id: identity
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          SOURCE_SHA: ${{ github.event.workflow_run.head_sha }}
+          SOURCE_SHA: ${{ github.sha }}
         with:
           script: |
             const currentMain = await github.rest.git.getRef({

docs/40-deployment/web-delivery.md

@@ -20,11 +20,11 @@ The browser-side authority behind this invariant belongs to
 ## Production Pages
 
 [`.github/workflows/pages-deploy.yml`](../../.github/workflows/pages-deploy.yml) owns production
-delivery. A successful `Client checks` run for a protected-`main` push selects that exact source
-SHA, while delivery rejects the run if a newer revision supersedes it. The delivery job consumes
-no check artifact: it checks out the exact source, installs the frozen workspace, builds the
-release, reverifies `main`, and deploys those same-run bytes to the Cloudflare Pages `main` branch
-in the protected `production` environment.
+delivery. A protected-`main` push selects that exact source SHA after strict required PR checks,
+while delivery rejects the run if a newer revision supersedes it. The delivery job checks out the
+exact source, installs the frozen workspace, builds the release, reverifies `main`, and deploys
+those same-run bytes to the Cloudflare Pages `main` branch in the protected `production`
+environment.
 
 The workspace lock owns the exact Wrangler version, and Pages production/preview execute it through
 the pinned pnpm toolchain. Preview cleanup is intentionally different: its tombstone is a standalone