refactor: comments state current behavior, not project history

Comments across the tree justified the code by pointing at a Rust
implementation that is no longer in the repository, citing files and line
numbers (config.rs:132, schema.rs:26-54, reader.rs:42) that cannot be
opened, plus crates and datasets that are equally gone. A reader could not
check any of it.

Every invariant those comments carried is kept and restated so it stands on
its own: the bytewise sort that decides which row survives a duplicate exam
number, the literal U+0300..U+036F range that must match the site's toAscii,
the trailing space in "SINH ", the BIFF and shared-string corrections, the
VACUUM-after-COMMIT rule, the deploy-from-main guard.

The reader's contract is now anchored to the frozen oracle in
parser/testdata, which still exists and is still checked, rather than to the
tool that originally produced it.

TestDDLMatchesRust becomes TestDDLIsFrozen: it compares against a copy of
the DDL inside the test and never read schema.rs, so both the name and the
failure message were misleading.

ToAscii no longer claims the d-replacement must precede lowercasing. Both
cases map to 'd' and ToLower runs last, so the order has no effect.

.github/workflows/deploy-pages.yml

@@ -3,10 +3,8 @@ name: Deploy to GitHub Pages
 on:
   push:
     branches: [main]
-  # Pull requests run the build job only. Before this, the workflow triggered on
-  # main-push and workflow_dispatch alone, so "verify on a branch first" was not
-  # actually possible: pushing to a branch ran nothing, and dispatching from one
-  # published that branch straight to the live site.
+  # Pull requests run the build job only: the deploy job is guarded to main, so
+  # a branch can be verified end to end without touching the live site.
   pull_request:
   workflow_dispatch:
 
@@ -92,9 +90,10 @@ jobs:
           path: _site
 
   deploy:
-    # Guarded to main. Without this, a workflow_dispatch from any branch would
-    # publish that branch's output to the live site, and concurrency
-    # cancel-in-progress would kill an in-flight good deploy on the way.
+    # Deploy only from main. pull_request and workflow_dispatch both run on
+    # other branches, and publishing one would put that branch's output on the
+    # live site while concurrency cancel-in-progress killed an in-flight good
+    # deploy on the way.
     if: github.ref == 'refs/heads/main'
     needs: build
     runs-on: ubuntu-latest