Fix Pages deploy concurrency and tag successful deploys (#237)

* Use safe concurrency pattern for Pages deploys

Switch to the group: pages, cancel-in-progress: false pattern GitHub
recommends for deploy-pages, so a superseded run is skipped before it
starts rather than killed mid-deploy, which can leave the Pages
deployment stuck in progress.

* Tag each successful Pages deploy

There is currently no record of which commits were actually deployed.
Tag the deployed commit as deploy-YYYY-MM-DD-<sha> right after
deploy-pages succeeds, giving a lightweight, always-unique history of
production deploys without introducing a formal versioning/release
scheme.

.github/workflows/deploy.yml

@@ -5,8 +5,8 @@ on:
     branches:
       - 'main'
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  group: pages
+  cancel-in-progress: false
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -33,11 +33,21 @@ jobs:
     permissions:
       pages: write
       id-token: write
+      contents: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
       - name: Deploy to GitHub Pages
         id: deployment
         uses: actions/deploy-pages@v5
+      - name: Tag deploy
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          tag="deploy-$(date +%Y-%m-%d)-${GITHUB_SHA::7}"
+          git tag "$tag"
+          git push origin "$tag"