Require an approval stamp on every blog post before building

Posts are written in a private drafts repo and only reach this repo through
an approval step that stamps them with an HMAC over path and content. The
deploy workflow now runs scripts/verify-approvals.mjs before the build and
refuses to build if a post is unstamped, changed after approval, or still
marked as a draft (this repo is public, so a draft here is already published).

PW_PREVIEW=1 builds the site under /udkast for the private review page:
noindex, a banner, no service worker, sitemap or comments.

The nine existing posts are stamped as approved.

Claude-Session: https://claude.ai/code/session_01JmhJG6JnhXfzNiKv8f2vHu

.gitea/workflows/deploy.yml

@@ -35,6 +35,12 @@ jobs:
           npm install --include=optional --os=linux --libc=glibc --cpu=x64 sharp
           node -e "console.log('sharp', require('sharp').versions.sharp)"
 
+      # Intet indlæg bygges uden godkendelse; se scripts/verify-approvals.mjs.
+      - name: Verify blog approvals
+        env:
+          PUBLISH_KEY: ${{ secrets.PUBLISH_KEY }}
+        run: node scripts/verify-approvals.mjs
+
       - name: Build site
         run: npm run build