feat(deploy): publish to GitHub Pages and Cloudflare Pages

Build the site from one source and deploy it to both hosts from GitHub
Actions, so neither depends on a host's default Jekyll toolchain.

- Gemfile/Gemfile.lock pin Jekyll 4.4.1 on Ruby 3.4; both workflows use
  them, which keeps the two sites on an identical toolchain
- _config.yml carries the GitHub Pages url and baseurl, fixing asset
  paths that previously resolved off-site; _config.cloudflare.yml layers
  over it for the pages.dev root
- wrangler.jsonc declares the Pages project name and output directory
- 404.html gives both hosts a page for unmatched routes
- exclude README.md from the output and stop shipping CSS sourcemaps

.github/workflows/github-pages.yml

@@ -0,0 +1,49 @@
+name: Deploy to GitHub Pages
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Let a running deploy finish rather than cancelling it mid-publish.
+concurrency:
+  group: github-pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.4'
+          bundler-cache: true
+
+      # Uses _config.yml only, which carries the tiennm99.github.io/penny-pincher-provider
+      # url and baseurl. actions/configure-pages is deliberately not used — it would
+      # overwrite that baseurl with its own guess.
+      - name: Build site
+        run: bundle exec jekyll build
+        env:
+          JEKYLL_ENV: production
+
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: _site
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4