Keep Synthetic demo green before Pages is enabled

[mohsinht]

What changed

• always build, validate, budget-check, and upload the public demo artifact on main
• deploy only after ZAATI_ENABLE_DEMO_PAGES=true or an explicit manual deploy input
• add the official Pages configuration step
• upgrade the Pages actions to Node 24 versions and pin every action to an immutable SHA
• document the one-time Pages setup for maintainers and forks

Why

The asset-path failure is fixed in #17. The remaining red run is repository configuration: GitHub returns 404 because Pages has never been enabled. A fresh fork should not report broken CI merely because an optional public deployment has not been configured.

Verification

• Prettier passes
• repository policy passes for all workflows and exact dependency pins
• workflow YAML parses successfully

After this merges, normal pushes stay green. Enabling Pages plus the documented variable turns deployment on.