fix(website): the catalog refresh runs the checks its counts must pass

[gHashTag]

The apex publisher (gHashTag/ghashtag.github.io publish-website.yml, run 36893486012, 2026-10-01 16:38Z) failed at Build: onboarding-from-spec: 9 problem(s). #1176 (t27 worlds: refresh the catalog) had moved public/t27/manifest.json to 1737 specs and 14 repositories, and specs/catalog/onboarding.t27 still said 1577 and 12. The same refresh left check:silicon red on two vendored gf16 ports.

#1212 has since written the counts and the two silicon exclusions; this branch merged it. What remains here is what #1212 did not do:

file	what
.github/workflows/t27-world-scan.yml	npm run check:onboarding and npm run check:silicon in Catalog gates. #1176 merged with Website checks red, because only T27 work report is required. The refresh never ran either check, so the publish was the first place the disagreement surfaced. A refresh that moves the counts now stops before it commits.
specs/catalog/onboarding.t27	MEASURED_AT 2026-10-01: #1212 kept 2026-09-24 beside the 2026-10-01 numbers
same	prose the new numbers made false. It said "every remaining fail never parsed", but 175 − 169 = 6 specs now parse and lose only Verilog (queen-rehearsal, gen_w312, run_v51_multiple, health_check, gen_mock, trios-mesh/tools/deploy)
public/llms.txt, public/agents.t27	regenerated from the spec

Verified: npm run prebuild:ci exit 0; onboarding-from-spec --check up to date (10 tests, 54 asserts hold); check:silicon classifies every spec; Website checks run 36900947748 green on the pre-merge head.

🤖 Generated with Claude Code

{
  "version": 1,
  "head_sha": "342451a266b355d19ee549e5d106b5833741bf38",
  "summary": "The t27.ai publish failed because a catalog refresh (#1176) moved the manifest without the onboarding snapshot, and the refresh job never ran the check that compares them. #1212 has since fixed the numbers; this adds check:onboarding and check:silicon to the refresh's own gates, and corrects the date and the prose the new numbers falsified.",
  "changes": [
    ".github/workflows/t27-world-scan.yml: npm run check:onboarding and npm run check:silicon added to Catalog gates",
    "apps/website/specs/catalog/onboarding.t27: MEASURED_AT 2026-10-01; a paragraph recording the 2026-10-01 refresh; 'every remaining fail never parsed' replaced -- six specs now parse and fail only Verilog",
    "apps/website/public/llms.txt and public/agents.t27 regenerated by node scripts/onboarding-from-spec.mjs"
  ],
  "tests": [
    {
      "command": "cd apps/website && npm ci && npm run prebuild:ci",
      "status": "passed",
      "result": "exit 0 for the whole chain, onboarding-from-spec included",
      "evidence": "local run; failing main build before #1212: gHashTag/ghashtag.github.io run 36893486012"
    },
    {
      "command": "cd apps/website && node scripts/onboarding-from-spec.mjs --check && npm run check:silicon",
      "status": "passed",
      "result": "up to date, spec tests 10 asserts 54 all hold; every spec naming a verified format is classified",
      "evidence": "local run on 342451a26"
    },
    {
      "command": "Website checks (workflow_dispatch on the branch)",
      "status": "passed",
      "result": "success on 7ef402eeb, before merging main",
      "evidence": "https://github.com/gHashTag/trinity/actions/runs/36900947748"
    }
  ],
  "limitations": [
    "The world-scan gate is not exercised here; its next refresh that moves the counts will stop at check:onboarding until someone writes them, so the catalog can go stale where the site used to break.",
    "Website checks remains non-required on main, which is how #1176 merged red; this PR does not change branch protection."
  ],
  "tags": [
    "Engineering",
    "Verification"
  ],
  "blog": {
    "title": "The gate was on the publish path, not on the job that changed its input",
    "summary": "A bot refresh moved the numbers a spec states about the corpus, merged with the comparing check red, and the site's publish was the first job to refuse it.",
    "outline": [
      "The apex publish failed on a stale corpus snapshot that a bot refresh had invalidated.",
      "The counts were fixed in parallel; this change moves the comparing checks into the refresh itself and corrects the prose the new numbers falsified.",
      "Non-required checks let a red bot PR merge; whether Website checks should be required is left to the owner."
    ]
  }
}