Validate wiki publish before deleting previews

[coisa]

Objective

Validate that wiki publish actually updates the remote wiki publish branch before deleting the PR preview branch.

Current Limitation

The wiki workflow publishes PR preview content to the wiki master branch after merge and then deletes the pr-<number> preview branch. A previous implementation showed that a job can appear successful without advancing the publish branch when the push step is not explicit enough.

Proposed Work

Add a post-publish validation step that compares the remote wiki publish branch SHA with the expected preview SHA before deleting the preview branch.

Scope

• Capture the expected preview branch SHA before publishing.
• Push the publish branch.
• Fetch or query the remote publish branch SHA after publishing.
• Fail the job if the publish branch does not match the expected SHA.
• Delete the preview branch only after validation passes.

Non-goals

• Changing the wiki generation command.
• Changing the wiki publish branch name.
• Publishing to multiple wiki branches.

Acceptance Criteria

Functional Criteria

• Wiki publish records the expected preview branch commit SHA.
• Wiki publish verifies the remote publish branch points to the expected SHA after push.
• The workflow fails before cleanup if validation fails.
• Preview branch deletion only runs after successful publish validation.
• Workflow logs clearly show expected and actual SHAs.

Architectural / Isolation Criteria

• Validation logic is implemented with deterministic Git commands.
• The workflow remains safe under branch protection constraints.
• Cleanup never deletes the last available preview source before publish is verified.