governance: add surface/writing lane

[ChBrain]

The writing surface deploys to writing.kaihacks.ai and stages at /writing/, but khai-guard.config.json has no surface/writing/* lane — its pages under src/pages/writing/** are unowned, so per the branch contract no branch can legally touch them (creating a surface is a governance act; this is that act, after the fact).

One explicit lane, same shape as the other surfaces. No page change rides along: on inspection the archive shelf already has a proper empty state via the Shelf chassis ("No captured runs deposited yet…"), so this is purely unblocking future writing-surface work.

🤖 Generated with Claude Code

https://claude.ai/code/session_0176ZYTwoV8V4So9SBTizc5X

[ChBrain]

Local handoff — cut the release (the CI sandbox's git proxy rejects tag pushes; run this at home)

git fetch origin main
git checkout -B chore/cut-release origin/main
git tag -a main-v0.2.0 -m main-v0.2.0
git tag -a architecture-v0.2.0 -m architecture-v0.2.0
git tag -a plays-v0.2.0 -m plays-v0.2.0
git tag -a cultures-v0.1.0 -m cultures-v0.1.0
git tag -a misfits-v0.1.0 -m misfits-v0.1.0
git tag -a writing-v0.1.0 -m writing-v0.1.0
git push origin main-v0.2.0 architecture-v0.2.0 plays-v0.2.0 cultures-v0.1.0 misfits-v0.1.0 writing-v0.1.0

The checkout to chore/cut-release matters: the pre-push guard classifies the checked-out branch name even for pure tag pushes, and main matches no lane.

Verify: each pushed tag fires one deploy-production run in the Actions tab — six runs total (main-v* also refreshes the apex per its subpath mapping). All six surfaces were verified on staging at this commit.

On failure: if a deploy-production run goes red, nothing has shipped for that surface; re-run the job from the Actions tab, or dispatch deploy-surface manually with that surface + env=production.

---

Generated by Claude Code

[ChBrain]

Cut the release. Run every command in order, from the repository root, on a machine with push access.

git fetch origin main
git checkout -B chore/cut-release origin/main
git tag -a main-v0.2.0 -m main-v0.2.0
git tag -a architecture-v0.2.0 -m architecture-v0.2.0
git tag -a plays-v0.2.0 -m plays-v0.2.0
git tag -a cultures-v0.1.0 -m cultures-v0.1.0
git tag -a misfits-v0.1.0 -m misfits-v0.1.0
git tag -a writing-v0.1.0 -m writing-v0.1.0
git push origin main-v0.2.0 architecture-v0.2.0 plays-v0.2.0 cultures-v0.1.0 misfits-v0.1.0 writing-v0.1.0

Verify: six deploy-production workflow runs appear in the Actions tab, one per tag, and all six finish green.

On failure: re-run the failed deploy-production run from the Actions tab, or run the deploy-surface workflow manually with inputs surface= and env=production.

This comment supersedes the handoff comment above.

---

Generated by Claude Code

[ChBrain]

Deploy the release to production. The tags and releases for 82a0366 exist but fired no deploys (they were created with an automation token, and GitHub suppresses workflow triggers for GITHUB_TOKEN events). Run every command in order on a machine where gh is authenticated as ChBrain.

gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=main -f env=production
gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=architecture -f env=production
gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=plays -f env=production
gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=cultures -f env=production
gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=misfits -f env=production
gh workflow run deploy-surface.yml --repo ChBrain/website --ref main -f surface=writing -f env=production

main is at 82a0366, the exact commit the six release tags point at, so the deployed content is identical to the tagged release.

Verify: six deploy-surface runs appear in the Actions tab and finish green.

On failure: re-run the failed run from the Actions tab.

This comment supersedes the two handoff comments above.

---

Generated by Claude Code