Build the site with the pinned Jekyll instead of github-pages

[amjjbonvin]

Resolves item 3 of UPGRADE.md.

Problem

Both workflows used actions/jekyll-build-pages, which copies its own
Gemfile (pinning the github-pages gem) into a container and ignores this
repository's. The published site was built with Jekyll 3.10.0 while local
previews used the Jekyll 4.4.1 pinned in Gemfile.lock, and CI warned
github-pages can't satisfy your Gemfile's dependencies on every run.

Practically, this meant Gemfile.lock governed local development only — so the
Dependabot fixes in 6e817a9 changed no gem in the published build.

Change

Both workflows now use ruby/setup-ruby + bundle exec jekyll build:

• Gemfile.lock governs the published site, so dependency pins and Dependabot
  alerts apply to production.
• build.yml uses the same toolchain as the deploy, so a green check actually
  predicts a green deploy.
• New .ruby-version (3.4.5) is the single source of truth, read by both workflows.
• build.yml drops the pages: write / id-token: write permissions it never needed.
• UPGRADE.md is excluded from the generated site.

baseurl is deliberately left at "" and steps.pages.outputs.base_path is not
consumed — the site is served from a custom apex domain (see CNAME), and
passing it would prefix every URL with a repository subpath.

Regression found and fixed

_layouts/home.html listed recent news via site.categories.news, whose
ordering Jekyll 4 does not guarantee to match Jekyll 3. Under Jekyll 4 the
homepage showed news items from 2014 instead of the current ones. Fixed with an
explicit | sort: 'date' | reverse, which behaves identically on both engines.

The /news/ index was unaffected (it uses site.posts), as was
site.related_posts.

Verification

A 24-page random sample was diffed against the live Jekyll 3 site:

Result	Pages
Byte-identical	21
Differ by blank lines only	3

The homepage matches to within two blank lines inside an excerpt.

The comparison must be run with TZ=UTC: _config.yml sets no timezone, so a
local build stamps <time datetime> as +01:00 where the runners stamp
+00:00. The rendered date text is identical either way; without TZ=UTC this
artifact masks the real comparison. Setting timezone: explicitly is left as an
optional follow-up since it would change published offsets.

🤖 Generated with Claude Code

[amjjbonvin]

Copilot code review:

Verdict: looks good to merge.

I didn’t find any blocking issues in this PR.

Why it looks solid:

The root cause was real: the site was being built with actions/jekyll-build-pages, which uses its own github-pages gemset and ignores the repo’s Gemfile.lock. This change fixes that by standardizing both workflows on ruby/setup-ruby + bundle exec jekyll build.
.ruby-version gives a single source of truth for the Ruby version, and the workflow now reads it consistently.
The homepage fix in _layouts/home.html is the right workaround for the Jekyll 3 vs 4 ordering change: explicitly sorting site.categories.news prevents the regression.
Excluding UPGRADE.md from the generated site is sensible, and the workflow cleanup (pages: write / id-token: write removal) matches the actual needs.