feat(trust): publish the per-version fidelity matrix from CI's own reports

[danfry1]

Problem

The RN × Vitest matrix runs the mock-vs-real-RN cross-check for every cell on every commit — and throws the per-cell reports away. The published fidelity page is a single-version snapshot rendered locally, so the project's strongest trust evidence (per-version parity, produced by CI itself) was invisible.

Change

• Matrix cells upload their cross-check report.json as artifacts (if: always() — a diverging cell's report is the forensic record; 30-day retention).
• New renderer scripts/fidelity-matrix.mjs aggregates per-cell reports into website/guide/fidelity-matrix.md: an RN × Vitest summary table (resolved versions from the reports themselves) plus a per-probe divergence table. Every report field renders through a shared escape covering the VitePress hazards (pipes, tags, Vue interpolation) and backticks — reports are CI artifacts and are treated as untrusted data end to end.
• pages.yml re-deploys when the matrix completes on main (workflow_run) and, before building, downloads the latest successful non-pull_request matrix run's artifacts and regenerates the page in the deploy workspace. Nothing generated is committed; the committed page is a placeholder that keeps local builds and dead-link checks working, now drift-gated by fidelity:check so real data can never land in the repo unnoticed.
• crosscheck.mjs records the resolved Vitest version (the matrix's second axis); the fidelity report page links to the matrix; sidebar entry added.

Security

The pre-PR adversarial review caught a real artifact-poisoning vector in the first draft: selecting runs by head-branch name would have let a fork PR (fork default branch is main) with a modified workflow publish attacker-controlled content to the docs site. The selection now excludes pull_request runs entirely — only push/schedule/dispatch runs, which execute trusted main-branch code, are eligible — and the deploy job skips fork-triggered workflow_run events outright. All rendered report fields are escaped as untrusted input as defense in depth.

Behavior notes

• A failed matrix run (any divergence) is never published — the site keeps showing the last all-green run while CI is red; the divergence table renders only for manually-supplied report directories (documented in-code).
• With no eligible run or expired artifacts, the placeholder ships — the site build never depends on matrix availability.

Tests

7 tests execute the real script: placeholder render, numeric-sorted aggregation, per-cell rows, escaping of reasons AND hostile probe names (backtick/pipe/HTML injection), artifact-name fallback, corrupt-JSON failure (placeholder ships), and the --check drift gate both ways.

Full gate: mock suite 1299, crosscheck 75/75 (report now carries vitestVersion), fidelity:check (both pages), website build, YAML lint, lint/format/typecheck clean.